Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe
Analysis ID:	1546636
MD5:	5009b1ef6619eca039925510d4fd51a1
SHA1:	22626aa57e21291a995615f9f6bba083d8706764
SHA256:	fbc8c32bf799a005c57540a2e85dd3662ed5795a55f11495f0ba569bbb09df59
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe (PID: 7420 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe" MD5: 5009B1EF6619ECA039925510D4FD51A1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["arenbootk.sbs", "strikebripm.sbs", "ostracizez.sbs", "definitib.sbs", "activedomest.sbs", "offybirhtdi.sbs", "mediavelk.sbs", "elaboretib.sbs"], "Build id": "4SD0y4--MAGISTER"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:22:00.071140+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.102.49.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (activedomest .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:21:59.136713+0100	2056835	1	Domain Observed Used for C2 Detected	192.168.2.4	64324	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (arenbootk .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:21:59.062676+0100	2056838	1	Domain Observed Used for C2 Detected	192.168.2.4	61149	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (definitib .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:21:59.108355+0100	2056844	1	Domain Observed Used for C2 Detected	192.168.2.4	51005	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (elaboretib .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:21:59.098384+0100	2056847	1	Domain Observed Used for C2 Detected	192.168.2.4	64870	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mediavelk .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:21:59.123990+0100	2056841	1	Domain Observed Used for C2 Detected	192.168.2.4	64140	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offybirhtdi .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:21:59.147962+0100	2056832	1	Domain Observed Used for C2 Detected	192.168.2.4	53984	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ostracizez .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:21:59.076356+0100	2056853	1	Domain Observed Used for C2 Detected	192.168.2.4	52998	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (strikebripm .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:21:59.087484+0100	2056850	1	Domain Observed Used for C2 Detected	192.168.2.4	64371	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T10:22:00.753590+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Avira: detected

Found malware configuration

Source: 0.2.SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe.810000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["arenbootk.sbs", "strikebripm.sbs", "ostracizez.sbs", "definitib.sbs", "activedomest.sbs", "offybirhtdi.sbs", "mediavelk.sbs", "elaboretib.sbs"], "Build id": "4SD0y4--MAGISTER"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

ReversingLabs: Detection: 79%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: offybirhtdi.sbs
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: activedomest.sbs
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: arenbootk.sbs
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: mediavelk.sbs
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: definitib.sbs
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: elaboretib.sbs
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: strikebripm.sbs
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: ostracizez.sbs
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: arenbootk.sbs
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--MAGISTER

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-42h]	0_2_0081E1A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then jmp eax	0_2_0084E210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+75E07B5Ch]	0_2_0081E990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0000008Ah]	0_2_0081CF90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then add ecx, eax	0_2_0083A083
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-6Ch]	0_2_0083A083
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	0_2_00811000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	0_2_00811000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx]	0_2_0084F020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov esi, dword ptr [esp+1Ch]	0_2_0084F020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov edx, eax	0_2_0083702F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then jmp ecx	0_2_0082104F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+38h]	0_2_0082E07E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov ecx, dword ptr [0085DCFCh]	0_2_0084C132
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov esi, ecx	0_2_00852165
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then jmp ecx	0_2_00838290
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], B62B8D10h	0_2_0083D2FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov ebx, dword ptr [esp]	0_2_0083D2FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B62B8D10h	0_2_0083C3A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+29352E8Dh]	0_2_00855330
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	0_2_008114A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then jmp ecx	0_2_008214CE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov ebp, edx	0_2_008524E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov edx, dword ptr [esi+64h]	0_2_008415DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then jmp ecx	0_2_008535F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	0_2_008535F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+58h]	0_2_00832520
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax]	0_2_008336AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-3ED06EDAh]	0_2_0084C7A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0083E7B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_0083F73A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then jmp ecx	0_2_00853740
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	0_2_00853740
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_00840887
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00815890
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then add edx, esi	0_2_008398F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then jmp ecx	0_2_008539C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	0_2_008539C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov ecx, eax	0_2_0083F9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov dword ptr [esi+10h], edx	0_2_0083F9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_0083F9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0083F9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	0_2_00853A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then and esi, 001FF800h	0_2_00814BA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_2_0082FBA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+6D44C030h]	0_2_0083AB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9ABDB589h	0_2_0083AB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00848C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6D44C02Ch]	0_2_0084FC90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov edi, esi	0_2_0084BCA9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	0_2_0083ECE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_00854C40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	0_2_00853D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov word ptr [edx], bp	0_2_00831EC5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov word ptr [ecx], di	0_2_00831EC5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then jmp edx	0_2_00818EF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_00840F3E

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056838 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (arenbootk .sbs) : 192.168.2.4:61149 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056853 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ostracizez .sbs) : 192.168.2.4:52998 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056844 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (definitib .sbs) : 192.168.2.4:51005 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056835 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (activedomest .sbs) : 192.168.2.4:64324 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056850 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (strikebripm .sbs) : 192.168.2.4:64371 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056847 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (elaboretib .sbs) : 192.168.2.4:64870 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056841 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mediavelk .sbs) : 192.168.2.4:64140 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056832 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offybirhtdi .sbs) : 192.168.2.4:53984 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: arenbootk.sbs
Source: Malware configuration extractor	URLs: strikebripm.sbs
Source: Malware configuration extractor	URLs: ostracizez.sbs
Source: Malware configuration extractor	URLs: definitib.sbs
Source: Malware configuration extractor	URLs: activedomest.sbs
Source: Malware configuration extractor	URLs: offybirhtdi.sbs
Source: Malware configuration extractor	URLs: mediavelk.sbs
Source: Malware configuration extractor	URLs: elaboretib.sbs

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.102.49.254:443

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693148734.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb3e1a0cb63bea3f237584fc972a7c186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=37a25c73fac7d332a691bded; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26214Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 01 Nov 2024 09:22:00 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: arenbootk.sbs
Source: global traffic	DNS traffic detected: DNS query: ostracizez.sbs
Source: global traffic	DNS traffic detected: DNS query: strikebripm.sbs
Source: global traffic	DNS traffic detected: DNS query: elaboretib.sbs
Source: global traffic	DNS traffic detected: DNS query: definitib.sbs
Source: global traffic	DNS traffic detected: DNS query: mediavelk.sbs
Source: global traffic	DNS traffic detected: DNS query: activedomest.sbs
Source: global traffic	DNS traffic detected: DNS query: offybirhtdi.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692993562.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691498755.0000000001292000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692993562.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691498755.0000000001292000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692993562.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691498755.0000000001292000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=uDUW
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692993562.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691498755.0000000001292000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.0000000001296000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.0000000001296000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900iR
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691544688.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693148734.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb3e1a0cb63bea3f
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Code function: 0_2_00846B70 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_00846B70

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Code function: 0_2_00846B70 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_00846B70

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Code function: 0_2_00846D70 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

0_2_00846D70

System Summary

PE file contains section with special chars

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Static PE information: section name: .vmp+
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Static PE information: section name: .vmp+
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Static PE information: section name: .vmp+

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Code function: 0_2_00D09F73 NtDelayExecution,

0_2_00D09F73

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0081E1A0	0_2_0081E1A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0081F755	0_2_0081F755
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0081E990	0_2_0081E990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008170B0	0_2_008170B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008330E0	0_2_008330E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0082F0E6	0_2_0082F0E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008540E0	0_2_008540E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0084B0F0	0_2_0084B0F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00811000	0_2_00811000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00815000	0_2_00815000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0082D010	0_2_0082D010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0102019A	0_2_0102019A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A05000	0_2_00A05000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00836022	0_2_00836022
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0084F020	0_2_0084F020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083702F	0_2_0083702F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00855040	0_2_00855040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0082104F	0_2_0082104F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0082E07E	0_2_0082E07E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008F11BF	0_2_008F11BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008191E9	0_2_008191E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00831100	0_2_00831100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083A112	0_2_0083A112
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00883111	0_2_00883111
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00878147	0_2_00878147
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0096E157	0_2_0096E157
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00852165	0_2_00852165
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A64141	0_2_00A64141
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0087116C	0_2_0087116C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00838290	0_2_00838290
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009082BE	0_2_009082BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009322AC	0_2_009322AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00AE42FF	0_2_00AE42FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A152F3	0_2_00A152F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008112D5	0_2_008112D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A702FC	0_2_00A702FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083D2FD	0_2_0083D2FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00945211	0_2_00945211
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A0F226	0_2_00A0F226
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A0E22F	0_2_00A0E22F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00AEC208	0_2_00AEC208
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009C2220	0_2_009C2220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A76274	0_2_00A76274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0081A260	0_2_0081A260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A54246	0_2_00A54246
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083C3A6	0_2_0083C3A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008A53B3	0_2_008A53B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A3A399	0_2_00A3A399
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083B3D0	0_2_0083B3D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008FD3D2	0_2_008FD3D2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008383E2	0_2_008383E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083E3F0	0_2_0083E3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00811328	0_2_00811328
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00839328	0_2_00839328
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00855330	0_2_00855330
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009DC325	0_2_009DC325
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009E5349	0_2_009E5349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008C5352	0_2_008C5352
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00C24322	0_2_00C24322
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00AD4343	0_2_00AD4343
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0095849A	0_2_0095849A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0086949D	0_2_0086949D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008214CE	0_2_008214CE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008524E0	0_2_008524E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0088840A	0_2_0088840A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009B145C	0_2_009B145C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00820460	0_2_00820460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00844461	0_2_00844461
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A735BC	0_2_00A735BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009155D9	0_2_009155D9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008265D7	0_2_008265D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008415DC	0_2_008415DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009CBE92	0_2_009CBE92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008695E3	0_2_008695E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008535F0	0_2_008535F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0095751E	0_2_0095751E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083A510	0_2_0083A510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009CE50F	0_2_009CE50F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00FCC561	0_2_00FCC561
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00832520	0_2_00832520
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0084A523	0_2_0084A523
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083F570	0_2_0083F570
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008E1696	0_2_008E1696
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009336F8	0_2_009336F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008F4611	0_2_008F4611
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00899616	0_2_00899616
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00AEF608	0_2_00AEF608
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A32671	0_2_00A32671
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00AF77AB	0_2_00AF77AB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0084C7A0	0_2_0084C7A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0084B7B0	0_2_0084B7B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008C87DA	0_2_008C87DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0082D7F8	0_2_0082D7F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00852700	0_2_00852700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A0C70C	0_2_00A0C70C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083F73A	0_2_0083F73A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00853740	0_2_00853740
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008EC77F	0_2_008EC77F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00833770	0_2_00833770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00840887	0_2_00840887
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009C58AD	0_2_009C58AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A26891	0_2_00A26891
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008408B1	0_2_008408B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A6C8FE	0_2_00A6C8FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008398F2	0_2_008398F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0084F800	0_2_0084F800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A2A802	0_2_00A2A802
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0082E837	0_2_0082E837
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00879841	0_2_00879841
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008A2860	0_2_008A2860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00826997	0_2_00826997
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008379B0	0_2_008379B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0095A9AE	0_2_0095A9AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008539C0	0_2_008539C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083F9D0	0_2_0083F9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009419CB	0_2_009419CB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008929E0	0_2_008929E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00AE69C3	0_2_00AE69C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00813930	0_2_00813930
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009A3920	0_2_009A3920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00AED97C	0_2_00AED97C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0081DA80	0_2_0081DA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00D10ADA	0_2_00D10ADA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00853A90	0_2_00853A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0089BA9E	0_2_0089BA9E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A35ABF	0_2_00A35ABF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00817AB0	0_2_00817AB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009A7A37	0_2_009A7A37
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00824A4C	0_2_00824A4C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00C43BD6	0_2_00C43BD6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0082FBA0	0_2_0082FBA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00980BB1	0_2_00980BB1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00844BC7	0_2_00844BC7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083CBD0	0_2_0083CBD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0086EBD5	0_2_0086EBD5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00852B10	0_2_00852B10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008E2B16	0_2_008E2B16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083AB20	0_2_0083AB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00AF7B60	0_2_00AF7B60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00ABEC87	0_2_00ABEC87
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0084BCA9	0_2_0084BCA9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_008A4CCE	0_2_008A4CCE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0083ECE0	0_2_0083ECE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00D14CBE	0_2_00D14CBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00853D90	0_2_00853D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0081ADB0	0_2_0081ADB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00816D10	0_2_00816D10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009CBE92	0_2_009CBE92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0084AE90	0_2_0084AE90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A8BEE8	0_2_00A8BEE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00831EC5	0_2_00831EC5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00818EF0	0_2_00818EF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A10E39	0_2_00A10E39
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00843E24	0_2_00843E24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00823E45	0_2_00823E45
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00852FB0	0_2_00852FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00819FF5	0_2_00819FF5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0082CFFF	0_2_0082CFFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00A76F37	0_2_00A76F37
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_009A5F0F	0_2_009A5F0F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0102CEA4	0_2_0102CEA4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00840F3E	0_2_00840F3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0081DF60	0_2_0081DF60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00849F61	0_2_00849F61

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: String function: 0081C890 appears 69 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: String function: 0081E190 appears 152 times

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupportmainfresh_prog.exeL, vs SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000000.1666558485.0000000001095000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupportmainfresh_prog.exeL, vs SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Binary or memory string: OriginalFilenamesupportmainfresh_prog.exeL, vs SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Code function: 0_2_00842240 CoCreateInstance,

0_2_00842240

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

ReversingLabs: Detection: 79%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Section loaded: dpapi.dll	Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Static file information: File size 5952512 > 1048576

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Static PE information: Raw size of .vmp+ is bigger than: 0x100000 < 0x581a00

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp+

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Static PE information: section name: .vmp+
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Static PE information: section name: .vmp+
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Static PE information: section name: .vmp+

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0084E650 push eax; mov dword ptr [esp], F4F5F6F7h	0_2_0084E65E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_0089F7D8 push 0000000Dh; ret	0_2_008F5292
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00D14CBE push ebx; iretd	0_2_00B7DCC3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00869D32 push ebx; retf	0_2_00869D36
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	Code function: 0_2_00C74FE0 push ebp; ret	0_2_00C750E4

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	API/Special instruction interceptor: Address: C45AD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	API/Special instruction interceptor: Address: C3DA53
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	API/Special instruction interceptor: Address: 106F62F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	API/Special instruction interceptor: Address: B67272
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	API/Special instruction interceptor: Address: 1063D3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	API/Special instruction interceptor: Address: 1039AFA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	API/Special instruction interceptor: Address: 1058559

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Code function: 0_2_00A54246 rdtsc

0_2_00A54246

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe TID: 7440

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692915703.000000000126A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Code function: 0_2_00A54246 rdtsc

0_2_00A54246

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Code function: 0_2_00850F10 LdrInitializeThunk,

0_2_00850F10

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: offybirhtdi.sbs
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: activedomest.sbs
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: arenbootk.sbs
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: mediavelk.sbs
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: definitib.sbs
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: elaboretib.sbs
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: strikebripm.sbs
Source: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: ostracizez.sbs

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	2 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	79%	ReversingLabs	Win32.Adware.RedCap
SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	100%	Avira	HEUR/AGEN.1313486
SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
mediavelk.sbs	unknown	unknown	true	unknown
activedomest.sbs	unknown	unknown	true	unknown
ostracizez.sbs	unknown	unknown	true	unknown
definitib.sbs	unknown	unknown	true	unknown
strikebripm.sbs	unknown	unknown	true	unknown
arenbootk.sbs	unknown	unknown	true	unknown
offybirhtdi.sbs	unknown	unknown	true	unknown
elaboretib.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
strikebripm.sbs	true	unknown
ostracizez.sbs	true	unknown
offybirhtdi.sbs	true	unknown
mediavelk.sbs	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
definitib.sbs	true	unknown
elaboretib.sbs	true	unknown
activedomest.sbs	true	unknown
arenbootk.sbs	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://player.vimeo.com	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900iR	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.0000000001296000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692993562.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691498755.0000000001292000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692993562.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691498755.0000000001292000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/steam_refunds/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=uDUW	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692993562.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691498755.0000000001292000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb3e1a0cb63bea3f	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1692993562.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691498755.0000000001292000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690348149.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1691544688.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693148734.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000003.1690202682.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe, 00000000.00000002.1693043322.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546636
Start date and time:	2024-11-01 10:21:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 10 Number of non-executed functions: 181
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Simulations

Behavior and APIs

Time	Type	Description
05:21:58	API Interceptor	2x Sleep call for process: SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	HLZwUhcJ28.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	buNtKcYHCa.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	yt5xqAvHnZ.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.TR.Redcap.cdtxw.10783.3124.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9yJSTTEg68.exe	Get hash	malicious	Vidar	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	184.28.90.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.192.223.231
	Proposal From Wachler & Associates PC.pdf	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	96.6.168.143
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	104.117.244.112
	original.eml	Get hash	malicious	Mamba2FA	Browse	2.19.126.160
	Fw Message from Kevin - Update on Coles Supply Chain Modernisation 31-10-24.eml	Get hash	malicious	Unknown	Browse	23.201.252.83
	Setup.exe	Get hash	malicious	Unknown	Browse	184.28.89.148
	http://3d1.gmobb.jp/dcm299ccyag4e/gov/	Get hash	malicious	Phisher	Browse	184.28.88.244
	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4	Get hash	malicious	Unknown	Browse	23.38.98.83
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s599af221dbfd41b9a607812ebc66d2cf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VpSHltbG45MjdsQnBnZUJMcnhtMHM4QjRNbHFPTTJWd0ZlQTFNLWNhZ0lnRkE_ZT1aak8wczY&wd=target%28Sezione%20senza%20titolo.one%7C99ad2a4b-5ecc-495f-9ce8-040ac62eb8f2%2F%5BExternal%5D%20-%20Invoice%20%27s%208808-%7C9e6e973e-3cda-429a-a28f-c51dc242e5b1%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	184.28.89.164

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.874022549731662
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe
File size:	5'952'512 bytes
MD5:	5009b1ef6619eca039925510d4fd51a1
SHA1:	22626aa57e21291a995615f9f6bba083d8706764
SHA256:	fbc8c32bf799a005c57540a2e85dd3662ed5795a55f11495f0ba569bbb09df59
SHA512:	2b5bbd9449be00588058966db487c0adfac764827a6691f6a9fc6c3a770a93bda11c732d2eb2a3c660697cbc69b1c71a2bf76d2957f65cd2599fb28098b24f14
SSDEEP:	98304:S1DARPEaQuozISL3R0yFmGPwnvYw9iyiqWAWjuQCmtGlSliMhabgxEA:oFzuCII9CniytWjuQTtASl9hasb
TLSH:	8E5623CA2A97C0A6DAC01478D72BFBF621B25DE28D8A4D373DC178CE7071E75216D462
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............K...........@..........................P........[...@...................................>....

File Icon


Icon Hash:	62e8ecb6b6978b17

Static PE Info

General

Entrypoint:	0x8b0cd4
Entrypoint Section:	.vmp+
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1cb9cfd3ef9cd85ad4551f8f4172969a

Entrypoint Preview

Instruction
push esi
pushfd
mov esi, A1862BA3h
call 00007F4844C7741Bh
sub edi, 00000004h
mov ecx, 92874782h
mov edx, A70EBB07h
not ecx
mov eax, dword ptr [edi+ecx-6D78B87Dh]
xor eax, ebx
jmp 00007F4845028413h
push 9F15CEA3h
lea esp, dword ptr [esp+08h]
jmp 00007F4845033A2Dh
pop eax
adc dx, 2F28h
or cl, 0000003Ch
xadd word ptr [esp+01h], cx
ror ecx, 4Ah
xor bx, dx
and byte ptr [esp+ecx-54F42EC0h], FFFFFF89h
movsx eax, word ptr [esp+ecx-54F42EC0h]
mov word ptr [edi+ecx-54F42EC4h], dx
shl byte ptr [esp+ecx-54F42EBDh], 00000045h
call 00007F4844D317F9h
sub eax, ecx
sub esi, ecx
bsf ecx, edi
test dx, si
adc dl, 00000006h
mov ecx, dword ptr [ebp-38h]
mov dx, cx
test ax, sp
stc
shr dx, 0005h
cmc
sub cx, dx
cmp sp, 7CB3h
jmp 00007F4844C11EFCh
mov ecx, E995ABAAh
dec cl
mov byte ptr [edx], al
mov dword ptr [esp+08h], ecx
lea edx, dword ptr [88233ABEh+ecx*4]
push edx
lea ebp, dword ptr [ebp+edx*2-5CF3D2C8h]
mov edx, dword ptr [esp+08h]
add edx, FFD26888h
jmp edx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3eb990	0xa0	.vmp+
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x886000	0x2e0cd	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x885000	0x65c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x302000	0xdc	.vmp+
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x44901	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x46000	0x253d	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x49000	0xf3b8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp+	0x59000	0x2a8fa4	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp+	0x302000	0x264	0x400	8c4764afdf27947eae39c99eb090a8e5	False	0.2099609375	data	1.453711215340228	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp+	0x303000	0x581950	0x581a00	8e4ba3b1cc83dc7a27badb62ccbc9dfe	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x885000	0x65c	0x800	df935d7597f073b54073c31f253114a9	False	0.42578125	data	3.6185785025126203	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x886000	0x2e0cd	0x2aa00	026f49131debc2e51e715022f7899e28	False	0.6065627291055719	data	6.357319677385651	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE	0x8b087c	0xca4	data	English	United States	0.03350515463917526
RT_ICON	0x886538	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m	English	Great Britain	0.38625703564727953
RT_ICON	0x8875e0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m	English	Great Britain	0.22171705243268777
RT_ICON	0x88b808	0x54d5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9888106092001657
RT_ICON	0x890ce0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	Great Britain	0.7021276595744681
RT_ICON	0x891148	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	Great Britain	0.43692946058091287
RT_ICON	0x8936f0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	Great Britain	0.3110582041878623
RT_ICON	0x8a3f18	0xc293	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0005219730581598
RT_MENU	0x8b1520	0x50	empty	English	Great Britain	0
RT_STRING	0x8b1570	0x594	empty	English	Great Britain	0
RT_STRING	0x8b1b04	0x68a	empty	English	Great Britain	0
RT_STRING	0x8b2190	0x490	empty	English	Great Britain	0
RT_STRING	0x8b2620	0x5fc	empty	English	Great Britain	0
RT_STRING	0x8b2c1c	0x65c	empty	English	Great Britain	0
RT_STRING	0x8b3278	0x466	empty	English	Great Britain	0
RT_STRING	0x8b36e0	0x158	empty	English	Great Britain	0
RT_RCDATA	0x8b3838	0x800	empty			0
RT_GROUP_ICON	0x8b01ac	0x30	data	English	Great Britain	0.875
RT_GROUP_ICON	0x8b01dc	0x3e	data	English	Great Britain	0.8709677419354839
RT_VERSION	0x8b021c	0x394	OpenPGP Secret Key			0.40611353711790393
RT_MANIFEST	0x8b05b0	0x2ca	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5028011204481793
None	0x8b4038	0x95	empty	English	United States	0

Imports

DLL	Import
KERNEL32.dll	CopyFileW, ExitProcess, GetCommandLineW, GetCurrentProcessId, GetCurrentThreadId, GetLogicalDrives, GetSystemDirectoryW, GlobalLock, GlobalUnlock
SHELL32.dll	ShellExecuteW
USER32.dll	CloseClipboard, FindWindowExW, GetClipboardData, GetDC, GetForegroundWindow, GetSystemMetrics, GetWindowLongW, GetWindowThreadProcessId, IsWindowEnabled, IsWindowVisible, OpenClipboard, ReleaseDC
ole32.dll	CoCreateInstance, CoInitializeEx, CoInitializeSecurity, CoSetProxyBlanket, CoUninitialize
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear, VariantInit
GDI32.dll	BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, DeleteDC, DeleteObject, GetCurrentObject, GetDIBits, GetObjectW, GetPixel, SelectObject, StretchBlt
KERNEL32.dll	HeapAlloc, HeapFree, ExitProcess, GetModuleHandleA, LoadLibraryA, GetProcAddress

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T10:21:59.062676+0100	2056838	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (arenbootk .sbs)	1	192.168.2.4	61149	1.1.1.1	53	UDP
2024-11-01T10:21:59.076356+0100	2056853	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ostracizez .sbs)	1	192.168.2.4	52998	1.1.1.1	53	UDP
2024-11-01T10:21:59.087484+0100	2056850	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (strikebripm .sbs)	1	192.168.2.4	64371	1.1.1.1	53	UDP
2024-11-01T10:21:59.098384+0100	2056847	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (elaboretib .sbs)	1	192.168.2.4	64870	1.1.1.1	53	UDP
2024-11-01T10:21:59.108355+0100	2056844	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (definitib .sbs)	1	192.168.2.4	51005	1.1.1.1	53	UDP
2024-11-01T10:21:59.123990+0100	2056841	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mediavelk .sbs)	1	192.168.2.4	64140	1.1.1.1	53	UDP
2024-11-01T10:21:59.136713+0100	2056835	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (activedomest .sbs)	1	192.168.2.4	64324	1.1.1.1	53	UDP
2024-11-01T10:21:59.147962+0100	2056832	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offybirhtdi .sbs)	1	192.168.2.4	53984	1.1.1.1	53	UDP
2024-11-01T10:22:00.071140+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.102.49.254	443	TCP
2024-11-01T10:22:00.753590+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 10:21:59.175430059 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:21:59.175483942 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:21:59.175556898 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:21:59.198457003 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:21:59.198476076 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.071055889 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.071140051 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.074722052 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.074729919 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.075171947 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.122576952 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.149719954 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.191339970 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.753829002 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.753882885 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.753925085 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.753922939 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.753962040 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.753962994 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.753979921 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.753989935 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.754000902 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.754007101 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.754033089 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.754048109 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.762202024 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.762244940 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.762370110 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.762577057 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.814212084 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.814225912 CET	443	49730	104.102.49.254	192.168.2.4
Nov 1, 2024 10:22:00.814260006 CET	49730	443	192.168.2.4	104.102.49.254
Nov 1, 2024 10:22:00.814265966 CET	443	49730	104.102.49.254	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 10:21:59.062675953 CET	61149	53	192.168.2.4	1.1.1.1
Nov 1, 2024 10:21:59.071799040 CET	53	61149	1.1.1.1	192.168.2.4
Nov 1, 2024 10:21:59.076355934 CET	52998	53	192.168.2.4	1.1.1.1
Nov 1, 2024 10:21:59.085136890 CET	53	52998	1.1.1.1	192.168.2.4
Nov 1, 2024 10:21:59.087483883 CET	64371	53	192.168.2.4	1.1.1.1
Nov 1, 2024 10:21:59.097279072 CET	53	64371	1.1.1.1	192.168.2.4
Nov 1, 2024 10:21:59.098383904 CET	64870	53	192.168.2.4	1.1.1.1
Nov 1, 2024 10:21:59.107064009 CET	53	64870	1.1.1.1	192.168.2.4
Nov 1, 2024 10:21:59.108355045 CET	51005	53	192.168.2.4	1.1.1.1
Nov 1, 2024 10:21:59.121588945 CET	53	51005	1.1.1.1	192.168.2.4
Nov 1, 2024 10:21:59.123990059 CET	64140	53	192.168.2.4	1.1.1.1
Nov 1, 2024 10:21:59.133230925 CET	53	64140	1.1.1.1	192.168.2.4
Nov 1, 2024 10:21:59.136713028 CET	64324	53	192.168.2.4	1.1.1.1
Nov 1, 2024 10:21:59.145760059 CET	53	64324	1.1.1.1	192.168.2.4
Nov 1, 2024 10:21:59.147962093 CET	53984	53	192.168.2.4	1.1.1.1
Nov 1, 2024 10:21:59.157310963 CET	53	53984	1.1.1.1	192.168.2.4
Nov 1, 2024 10:21:59.159074068 CET	56897	53	192.168.2.4	1.1.1.1
Nov 1, 2024 10:21:59.166723013 CET	53	56897	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 10:21:59.062675953 CET	192.168.2.4	1.1.1.1	0x4204	Standard query (0)	arenbootk.sbs	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.076355934 CET	192.168.2.4	1.1.1.1	0x9b47	Standard query (0)	ostracizez.sbs	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.087483883 CET	192.168.2.4	1.1.1.1	0xcab5	Standard query (0)	strikebripm.sbs	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.098383904 CET	192.168.2.4	1.1.1.1	0xade5	Standard query (0)	elaboretib.sbs	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.108355045 CET	192.168.2.4	1.1.1.1	0xab66	Standard query (0)	definitib.sbs	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.123990059 CET	192.168.2.4	1.1.1.1	0xcdf5	Standard query (0)	mediavelk.sbs	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.136713028 CET	192.168.2.4	1.1.1.1	0x7a27	Standard query (0)	activedomest.sbs	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.147962093 CET	192.168.2.4	1.1.1.1	0x1b34	Standard query (0)	offybirhtdi.sbs	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.159074068 CET	192.168.2.4	1.1.1.1	0xd192	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 10:21:59.071799040 CET	1.1.1.1	192.168.2.4	0x4204	Name error (3)	arenbootk.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.085136890 CET	1.1.1.1	192.168.2.4	0x9b47	Name error (3)	ostracizez.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.097279072 CET	1.1.1.1	192.168.2.4	0xcab5	Name error (3)	strikebripm.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.107064009 CET	1.1.1.1	192.168.2.4	0xade5	Name error (3)	elaboretib.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.121588945 CET	1.1.1.1	192.168.2.4	0xab66	Name error (3)	definitib.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.133230925 CET	1.1.1.1	192.168.2.4	0xcdf5	Name error (3)	mediavelk.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.145760059 CET	1.1.1.1	192.168.2.4	0x7a27	Name error (3)	activedomest.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.157310963 CET	1.1.1.1	192.168.2.4	0x1b34	Name error (3)	offybirhtdi.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 1, 2024 10:21:59.166723013 CET	1.1.1.1	192.168.2.4	0xd192	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	7420	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 09:22:00 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-11-01 09:22:00 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 01 Nov 2024 09:22:00 GMT Content-Length: 26214 Connection: close Set-Cookie: sessionid=37a25c73fac7d332a691bded; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cb3e1a0cb63bea3f237584fc972a7c186; Path=/; Secure; HttpOnly; SameSite=None
2024-11-01 09:22:00 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-11-01 09:22:00 UTC	11747	IN	Data Raw: 22 3f 6c 3d 74 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 b9 81 e9 ab 94 e4 b8 ad e6 96 87 20 28 54 72 61 64 69 74 69 6f 6e 61 6c 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a Data Ascii: "?l=tchinese" onclick="ChangeLanguage( 'tchinese' ); return false;"> (Traditional Chinese)</a><a class="popup_menu_item tight" href="?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (J

Target ID:	0
Start time:	05:21:57
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe"
Imagebase:	0x810000
File size:	5'952'512 bytes
MD5 hash:	5009B1EF6619ECA039925510D4FD51A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	44.8%
Total number of Nodes:	87
Total number of Limit Nodes:	9

Executed Functions

Function 0081E1A0 Relevance: 23.0, Strings: 18, Instructions: 549
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M%E', xrefs: 0081ED17
dc, xrefs: 0081EDC0
6, xrefs: 0081EE5D
8]S_, xrefs: 0081ED87
7U9W, xrefs: 0081ED77
O9M;, xrefs: 0081ED3F
6E+G, xrefs: 0081ED57
>M"O, xrefs: 0081ED67
jabc, xrefs: 0081ED8F
5Q<S, xrefs: 0081ED6F
Ehrd, xrefs: 0081E68F
<Y?[, xrefs: 0081ED7F
I)^+, xrefs: 0081ED1F
E-A/, xrefs: 0081ED27
i[k], xrefs: 0081E4C3
&A-C, xrefs: 0081ED4F
eI?K, xrefs: 0081ED5F
P!N#, xrefs: 0081ED0F

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: &A-C$5Q<S$6$6E+G$7U9W$8]S_$<Y?[$>M"O$E-A/$Ehrd$I)^+$M%E'$O9M;$P!N#$dc$eI?K$i[k]$jabc
API String ID: 0-2281983721
Opcode ID: e57993c547228d5bae70365a8007149b7837d11d4d9d4832b4317739d099a66f
Instruction ID: 99c7ea950ffbf78ad219b1c1eda104a6d65725ed3fc4ce0e0a1f4d4999e63f7f
Opcode Fuzzy Hash: e57993c547228d5bae70365a8007149b7837d11d4d9d4832b4317739d099a66f
Instruction Fuzzy Hash: 7302E575908351CFD310CF25EC826ABBBE6FF85305F18492CE9C59B352E73989498B92

Function 0081E990 Relevance: 20.4, Strings: 16, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M%E', xrefs: 0081ED17
dc, xrefs: 0081EDC0
6, xrefs: 0081EE5D
8]S_, xrefs: 0081ED87
7U9W, xrefs: 0081ED77
O9M;, xrefs: 0081ED3F
6E+G, xrefs: 0081ED57
>M"O, xrefs: 0081ED67
jabc, xrefs: 0081ED8F
5Q<S, xrefs: 0081ED6F
<Y?[, xrefs: 0081ED7F
I)^+, xrefs: 0081ED1F
E-A/, xrefs: 0081ED27
&A-C, xrefs: 0081ED4F
eI?K, xrefs: 0081ED5F
P!N#, xrefs: 0081ED0F

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: &A-C$5Q<S$6$6E+G$7U9W$8]S_$<Y?[$>M"O$E-A/$I)^+$M%E'$O9M;$P!N#$dc$eI?K$jabc
API String ID: 0-600622405
Opcode ID: ef139196660dc68dae18393cca78a8ed623945de625cf5433b6a91dce192c771
Instruction ID: 4519474f5025dfd5e03180ced7598d61b276310b79e3108cabad29f6cc7c3dda
Opcode Fuzzy Hash: ef139196660dc68dae18393cca78a8ed623945de625cf5433b6a91dce192c771
Instruction Fuzzy Hash: F0C1E07160C3958FD320CF65D89079BBBE1EFD1354F18892DE4D48B392D379894A8B92

Function 0081CF90 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0081D096
ShellExecuteW.SHELL32(00000000,?,00858050,?,00000000,00000005), ref: 0081D196
GetForegroundWindow.USER32(?,00000000,00000005), ref: 0081D19C
GetCurrentProcessId.KERNEL32(?,00000000,00000005), ref: 0081D1A6
ExitProcess.KERNEL32 ref: 0081D1C6

Strings

89, xrefs: 0081D13F

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess$ExecuteExitForegroundShellThreadWindow
String ID: 89
API String ID: 1013327911-155395596
Opcode ID: 681f929ef97f11bd8404d22dc6c8e389543463239dd534bf33336ad4ec37406b
Instruction ID: e64d3be15b90775cbdcec9e14aea725bdf049d34e0ee980e697b929427552076
Opcode Fuzzy Hash: 681f929ef97f11bd8404d22dc6c8e389543463239dd534bf33336ad4ec37406b
Instruction Fuzzy Hash: 6E5159716487205BE318AB349C563AFBBD5FF82315F08892DD9C2EB2C2DD6D88054782

Function 0081F755 Relevance: 8.0, Strings: 6, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i#E%, xrefs: 0081FDF8
>kjm, xrefs: 0081FEAC
Jg3i, xrefs: 0081FEA2
S;W=, xrefs: 0081FDE4
5c;e, xrefs: 0081FE98
A'K), xrefs: 0081FE02

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 5c;e$>kjm$A'K)$Jg3i$S;W=$i#E%
API String ID: 0-468034204
Opcode ID: 00fb2b6b6430fe917929a1ecad06529ca179a3afe94771ce0a2ae94d03e64f54
Instruction ID: 20ae92728f74149d17d35c28f2ed5c2f7c557930f71d9112d766f6cdbbc8afb8
Opcode Fuzzy Hash: 00fb2b6b6430fe917929a1ecad06529ca179a3afe94771ce0a2ae94d03e64f54
Instruction Fuzzy Hash: E81285B4114700CFE3248F25D889FAABBB1FB45321F1A86ACD59A9F6B2D7749405CF42

Function 0084E210 Relevance: 1.6, APIs: 1, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0084E2A1

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8461057dea4a0a9e789e4cc2ea53ec919e5ece07e408a32a7afbdb7c35314365
Instruction ID: bdead01b300a1259723c58d9b7b58060a681a062c3f92c0f48f57278a8f30223
Opcode Fuzzy Hash: 8461057dea4a0a9e789e4cc2ea53ec919e5ece07e408a32a7afbdb7c35314365
Instruction Fuzzy Hash: EB116677E452208FC3148F28DCA2757BB6AFBCA712F1A053DDC849B680CA385906CBD1

Function 00D09F73 Relevance: 1.5, APIs: 1, Instructions: 19
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDelayExecution.NTDLL(0229EE29,00C1F46B,00C88143,9C2270B5,00FC6851,-23D1C6D8,00C63984,00BF9E50,19122212,2F93E81B,00C2A8E0,000000E0,?,74070D9F,42B0C93A,0104A8B6), ref: 00D09F7C

Memory Dump Source

Source File: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: fb9335dd4885cf5d61e025cfbe5bdc1a5acb7c1c2f63a563db71b9f4c9e748ad
Instruction ID: 77ae262de45022ac4340a4e8aba9ca0a100fd2789e1e395fe41d26ea68a2106b
Opcode Fuzzy Hash: fb9335dd4885cf5d61e025cfbe5bdc1a5acb7c1c2f63a563db71b9f4c9e748ad
Instruction Fuzzy Hash: 1DE03931B083528BC7A8EA25E74004EB7D0AAE4232F22493EE4C2532C4DA265D15AF53

Function 00850F10 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(008546AD,005C003F,00000006,?,?,00000018,?,?,?), ref: 00850F3E

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00851848 Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00851848
GetForegroundWindow.USER32 ref: 00851860

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 74f0c19085859b4057dd612fef88ded580caf715ef9845d0ebd89f16c7bd79cc
Instruction ID: 3a02cfbde8100047e8b4a04b1651a81796cd262d3a40c65f7e459ab704a57368
Opcode Fuzzy Hash: 74f0c19085859b4057dd612fef88ded580caf715ef9845d0ebd89f16c7bd79cc
Instruction Fuzzy Hash: EDD0A775581610978B0CD730BC2586B3626FB4530B718401AE90341326EE28230B8783

Function 00850E25 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00850ED8

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3ee8239beb4e3df15ec347665f83df87e30d704da0969881f65cad39087dd20f
Instruction ID: 823858587f25b6bb24534363a91d2bca63e87101d8b4659b884450e08fe4cba1
Opcode Fuzzy Hash: 3ee8239beb4e3df15ec347665f83df87e30d704da0969881f65cad39087dd20f
Instruction Fuzzy Hash: F3117D33F501268BCF1D8F78EC626AD7754FB08324B0907B9E916E7341EA78DA048780

Function 0084E1B0 Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0084E204

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1952d48a489ac483a0ec592cc1feea00ddd78aa085bad363e8d1ea9c908ac2fc
Instruction ID: 6e82ad4eca5937e9a776d712813b76bdaa75930914160948c06bb07d5233c1c5
Opcode Fuzzy Hash: 1952d48a489ac483a0ec592cc1feea00ddd78aa085bad363e8d1ea9c908ac2fc
Instruction Fuzzy Hash: 5FF0E97429D3405BD7088B10ECA17197FA6ABE1305F08487EE4D507391C27A181DD777

Non-executed Functions

Function 0084A523 Relevance: 72.9, Strings: 58, Instructions: 377COMMON

Download Yara Rule

Strings

(, xrefs: 0084A85B
C, xrefs: 0084A6BE
e, xrefs: 0084A7C8
@, xrefs: 0084A52F
3, xrefs: 0084A5E5
K, xrefs: 0084A686
9, xrefs: 0084A8C4
1, xrefs: 0084A559
9, xrefs: 0084A575
w, xrefs: 0084A74A
E, xrefs: 0084A6E8
i, xrefs: 0084A774
0, xrefs: 0084A601
<, xrefs: 0084A5BB
k, xrefs: 0084A766
O, xrefs: 0084A6A2
u, xrefs: 0084A758
/, xrefs: 0084A60F
y, xrefs: 0084A704
I, xrefs: 0084A694
[, xrefs: 0084A616
4, xrefs: 0084AACA
g, xrefs: 0084A7BA
Y, xrefs: 0084A624
_, xrefs: 0084A632
|, xrefs: 0084A647
?, xrefs: 0084A591
;, xrefs: 0084A8B6
A, xrefs: 0084A6CC
>, xrefs: 0084A8D9
M, xrefs: 0084A6B0
=, xrefs: 0084A8E0
c, xrefs: 0084A79E
+, xrefs: 0084A53D
8, xrefs: 0084A5D7
Q, xrefs: 0084A65C
x, xrefs: 0084A62B
], xrefs: 0084A640
-, xrefs: 0084A567
W, xrefs: 0084A66A
U, xrefs: 0084A678
?, xrefs: 0084A8D2
a, xrefs: 0084A7AC
S, xrefs: 0084A59F
}, xrefs: 0084A720
o, xrefs: 0084A782
H, xrefs: 0084A77B
G, xrefs: 0084A6DA
\, xrefs: 0084A727
|, xrefs: 0084A6C5
{, xrefs: 0084A6F6
q, xrefs: 0084A73C
m, xrefs: 0084A790
S, xrefs: 0084A64E
s, xrefs: 0084A72E
8, xrefs: 0084A5AD
2, xrefs: 0084A815
B, xrefs: 0084A7A5

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ($+$-$/$0$1$2$3$4$8$8$9$9$;$<$=$>$?$?$@$A$B$C$E$G$H$I$K$M$O$Q$S$S$U$W$Y$[$\$]$_$a$c$e$g$i$k$m$o$q$s$u$w$x$y${$|$|$}
API String ID: 0-901420310
Opcode ID: b57507b9fe23095618604d3d4150443d04437ee203acf5e774a622d0c56fb4ce
Instruction ID: 5d3a7409b4bd63a9bc07dc890bd2da79ea3a1b89eb22c9b5123f584bb6fe7bd2
Opcode Fuzzy Hash: b57507b9fe23095618604d3d4150443d04437ee203acf5e774a622d0c56fb4ce
Instruction Fuzzy Hash: 322250219087E989DB36C67C8C487DDBEA15B67324F0843D9D1E96B2D2C3B50B85CB62

Function 00849F61 Relevance: 44.0, Strings: 35, Instructions: 288COMMON

Download Yara Rule

Strings

9, xrefs: 0084A02A
3, xrefs: 0084A055
-, xrefs: 0084A07D
', xrefs: 0084A0A5
Y, xrefs: 0084A0AD
#, xrefs: 0084A095
G, xrefs: 0084A1A8
A, xrefs: 0084A1B8
?, xrefs: 0084A045
@, xrefs: 0084A0A1
X, xrefs: 0084A0B1
), xrefs: 0084A06D
7, xrefs: 0084A065
%, xrefs: 0084A09D
>, xrefs: 0084A167
!, xrefs: 0084A08D
H, xrefs: 0084A1B0
<, xrefs: 0084A15E
$, xrefs: 0084A015
5, xrefs: 0084A05D
M, xrefs: 0084A188
E, xrefs: 0084A099
4, xrefs: 00849FA5
s, xrefs: 00849FB3
r, xrefs: 0084A198
[, xrefs: 0084A0B5
h, xrefs: 00849F6D
+, xrefs: 0084A075
E, xrefs: 0084A190
t, xrefs: 0084A1A0
1, xrefs: 0084A04D
/, xrefs: 0084A085
=, xrefs: 0084A03D
0, xrefs: 0084A29C
;, xrefs: 0084A035

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !$#$$$%$'$)$+$-$/$0$1$3$4$5$7$9$;$<$=$>$?$@$A$E$E$G$H$M$X$Y$[$h$r$s$t
API String ID: 0-3672740722
Opcode ID: 398e6778f008d29b121f498d4bafcb3002af8d1f6df391f96a78de5a743fd48d
Instruction ID: 8adc46547ffed706f2b4a2fd30d53794f6910e9c83e658c3781aee39ba84facd
Opcode Fuzzy Hash: 398e6778f008d29b121f498d4bafcb3002af8d1f6df391f96a78de5a743fd48d
Instruction Fuzzy Hash: 6DE19121D086E98EDB26CA7C880839DBFB16B52314F1842DDD4E9AB3C2D7B54A45CB52

Function 008383E2 Relevance: 23.2, Strings: 18, Instructions: 687COMMON

Download Yara Rule

Strings

SX, xrefs: 00838E34
h#j=, xrefs: 008388CD
/$, xrefs: 00838D72
_Y, xrefs: 00838E29
pq, xrefs: 00838FCB
i'd!, xrefs: 008388C2
pq, xrefs: 0083919B
lF, xrefs: 00838E3F
@C, xrefs: 00838925
O\, xrefs: 00838E1E
G"A, xrefs: 0083891A
r3, xrefs: 008388F9
31, xrefs: 00838CF9
/E;C, xrefs: 008384CE
*, xrefs: 00838D88
2A"_, xrefs: 008384D9
m9O7, xrefs: 00838687
&+, xrefs: 00838D7D

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: G"A$&+$*$/E;C$/$$2A"_$@C$O\$SX$_Y$h#j=$i'd!$lF$m9O7$pq$pq$r3$31
API String ID: 0-1158987392
Opcode ID: 36a1f68fb96ac88854bb7c371fec76203d2dbaf10985b556529d208e2e906a5d
Instruction ID: aea852faa40c03889d34254602a9c6c337eb5bab979ab82fc7739e986cfd4d9d
Opcode Fuzzy Hash: 36a1f68fb96ac88854bb7c371fec76203d2dbaf10985b556529d208e2e906a5d
Instruction Fuzzy Hash: 35720CB41093858BE334CF25D881B9FBBE1FB96304F10892DD6E99B251EB749146CF92

Function 0084BCA9 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 343memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(49FB4BE2), ref: 0084BD1D
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0084BD67
SysAllocString.OLEAUT32(00000000), ref: 0084BDCB
SysAllocString.OLEAUT32(?), ref: 0084BE97
VariantInit.OLEAUT32(?), ref: 0084BF12
VariantClear.OLEAUT32(?), ref: 0084C07C
SysFreeString.OLEAUT32(?), ref: 0084C0A4
SysFreeString.OLEAUT32(?), ref: 0084C0AA
SysFreeString.OLEAUT32(?), ref: 0084C0BE

Strings

WC, xrefs: 0084BE0D
ZQ, xrefs: 0084BDFD

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearInitProxy
String ID: WC$ZQ
API String ID: 1721464176-1722601914
Opcode ID: 105c3ae7cf648d3b9b078e1278adac4c4a62a69aeed33b2f181737c0b275b7e0
Instruction ID: a0b8e1ad8634ccfad93babd2fdda21e9812185ec8b278f22562f4d8f8b584411
Opcode Fuzzy Hash: 105c3ae7cf648d3b9b078e1278adac4c4a62a69aeed33b2f181737c0b275b7e0
Instruction Fuzzy Hash: 57C1BA76508340DBE710CF64D845B5BBBE5FFC5315F10881CF595AB2A0CB79990ACB82

Function 00811000 Relevance: 19.5, Strings: 14, Instructions: 1998COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 008113FA, 0081146C
gfff, xrefs: 00811D13
, xrefs: 00813876
gfff, xrefs: 00811DCF
gfff, xrefs: 00811D85
0123456789ABCDEFXP, xrefs: 008113EC, 0081145F
-, xrefs: 00811CDD
gfff, xrefs: 00811D28
, xrefs: 008137DD
, xrefs: 008137EB
, xrefs: 008137F9
, xrefs: 008137E4
, xrefs: 00813800
, xrefs: 008137F2

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
API String ID: 0-3131871939
Opcode ID: b2394e9bd3c13d263de42f17031799623b94f2ac391ceb8fb8ee9e6db92b0525
Instruction ID: a74e77c4574bc77c9198e0825b463e9cd355385ecdc80524f76f1d2ea840f34b
Opcode Fuzzy Hash: b2394e9bd3c13d263de42f17031799623b94f2ac391ceb8fb8ee9e6db92b0525
Instruction Fuzzy Hash: 69E2F2716087818FCB18CF28C4943AABBE6FF95314F18866DE595CB391D734D989CB82

Function 0082FBA0 Relevance: 17.8, Strings: 13, Instructions: 1566COMMON

Download Yara Rule

Strings

RdOh, xrefs: 00830F94
&?3, xrefs: 0082FDA5
3210, xrefs: 0082FDB0
w`k, xrefs: 0083061A
dgfi, xrefs: 0082FFD5
,/.1, xrefs: 00830095
8;:5, xrefs: 0082FFFB
L, xrefs: 008303B5
h, xrefs: 00830742
4761, xrefs: 00830006
mdOh, xrefs: 00830FCA
X[Z], xrefs: 0082FFBD
8?, xrefs: 00830A19

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: &?3$,/.1$3210$4761$8;:5$8?$L$RdOh$X[Z]$dgfi$h$mdOh$w`k
API String ID: 0-3944949542
Opcode ID: 2fe6c700fc0656cb93e9548eac5777440653ba0c0aa2d5782dd61cf99ecc42c7
Instruction ID: d6fd909dda0675e611e1bdc87d295ef9c65e99398a3d1770929a34a30c6fa997
Opcode Fuzzy Hash: 2fe6c700fc0656cb93e9548eac5777440653ba0c0aa2d5782dd61cf99ecc42c7
Instruction Fuzzy Hash: F1B2CF7150C3818BD725CF29C4A17ABBBE2FFD6304F18896DE4C98B292D7749905CB92

Function 008379B0 Relevance: 16.4, APIs: 1, Strings: 8, Instructions: 662COMMON

Download Yara Rule

Strings

Mx, xrefs: 00837E14
Dw, xrefs: 00837CAF
wE, xrefs: 00837E0C
hv, xrefs: 008380AF
(, xrefs: 008380B6
DG, xrefs: 00837C9F
n~, xrefs: 00837C97
qVw, xrefs: 00837F66

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ($DG$Dw$Mx$hv$n~$wE$qVw
API String ID: 0-339588687
Opcode ID: bba7b982f3bfd8faf1bc1fb7406f70d46021bf2f778ce13f8e1bbe0cc923574f
Instruction ID: 4f7f2bef6a574f8192f5df26fab8a119e7f181878b0732cd94dd27a37b2f804d
Opcode Fuzzy Hash: bba7b982f3bfd8faf1bc1fb7406f70d46021bf2f778ce13f8e1bbe0cc923574f
Instruction Fuzzy Hash: B522CBB16083448FD714CF68D8816AFBBF5FF96314F14892CE8959B391D7788906CB92

Function 008112D5 Relevance: 16.0, Strings: 12, Instructions: 1008COMMON

Download Yara Rule

Strings

0000, xrefs: 008127ED
0, xrefs: 00812161
i, xrefs: 00812AC0
0000, xrefs: 008127D1
0000, xrefs: 0081283E
@, xrefs: 008129E2
0000, xrefs: 008127E6
0000, xrefs: 008127DF
0, xrefs: 0081220F
0000, xrefs: 008127D8
0000, xrefs: 008127CA
0, xrefs: 00812465

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: ae889f809ccb7c3ea6059d55be615c3c4e8e54339d704131e95419a29002196b
Instruction ID: fa716cc2516620844b13daaa873fd74ce9c2dc06d59fcecf2833c9ec0997f8bd
Opcode Fuzzy Hash: ae889f809ccb7c3ea6059d55be615c3c4e8e54339d704131e95419a29002196b
Instruction Fuzzy Hash: 5882AE71A093818FC719CE28C49079ABBE5FF99304F188A6DE49AD7391D334DD95CB82

Function 0081DA80 Relevance: 12.9, Strings: 10, Instructions: 369COMMON

Download Yara Rule

Strings

xy, xrefs: 0081DEA9
q`h}, xrefs: 0081DBD2
@ffI, xrefs: 0081DE91
yleh, xrefs: 0081DBDA
itkj, xrefs: 0081DBE2
p, xrefs: 0081D61E
@DvF, xrefs: 0081D894
uw, xrefs: 0081DD71
a[[d, xrefs: 0081D874
_kQT, xrefs: 0081D87C

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @DvF$@ffI$_kQT$a[[d$itkj$p$q`h}$xy$yleh$uw
API String ID: 0-2899419844
Opcode ID: 3756cbeeb4059458bb5fa6ae4511fb1b823aa8629fd3e330a91d89dddf0f1130
Instruction ID: cdc375782ee544243ed2ec41e9688d18aa9c950ee2f8b2fa350001104377db9d
Opcode Fuzzy Hash: 3756cbeeb4059458bb5fa6ae4511fb1b823aa8629fd3e330a91d89dddf0f1130
Instruction Fuzzy Hash: C6C1EFB02083849FD314DF25D8817ABBBE5EF96348F14892CE1D58B392D7788949CB97

Function 00820460 Relevance: 10.5, Strings: 8, Instructions: 454COMMON

Download Yara Rule

Strings

y)v', xrefs: 008204CA
#i4g, xrefs: 0082056B
yw, xrefs: 0082053F
+e(c, xrefs: 00820576
!m%k, xrefs: 00820560
@-+, xrefs: 008204C2
v%r#, xrefs: 008204D2
g!~_, xrefs: 008204DA

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !m%k$#i4g$+e(c$@-+$g!~_$v%r#$y)v'$yw
API String ID: 0-2667393304
Opcode ID: 588557bd658de79d684c5e74569ab65bb1ff4d216a94488b65ea85bd0c3abdeb
Instruction ID: b18720e77201ccf30cb9a2fe6f468bcddc0b0a4768d7aaf3f212206360b5cf30
Opcode Fuzzy Hash: 588557bd658de79d684c5e74569ab65bb1ff4d216a94488b65ea85bd0c3abdeb
Instruction Fuzzy Hash: BFF188B110C381DFE3248F24D8847ABBBE4FB85301F14992CEAD99B291D7798845CF92

Function 00846B70 Relevance: 9.2, APIs: 6, Instructions: 161clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00846B92
GetWindowLongW.USER32 ref: 00846BBD
GetClipboardData.USER32 ref: 00846BCD
CloseClipboard.USER32 ref: 00846D5B

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 11e5e2fe7f9da7a50c5989f25e83f5adee5ff748a7cdd3834a1617427d2e0dc5
Instruction ID: e70b44c8554216ffd37ac5d7d7ead1072e0bfdd9e020417a78e0229d7de561e9
Opcode Fuzzy Hash: 11e5e2fe7f9da7a50c5989f25e83f5adee5ff748a7cdd3834a1617427d2e0dc5
Instruction Fuzzy Hash: 3D5107B1E08786CBD700ABBCC84535ABFE0FB52314F058639C895D7681E7799968C793

Function 0082E837 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 292threadCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,F361F56A,?,00000000), ref: 0082E92F
GetWindowThreadProcessId.USER32(F361F56A,00000000), ref: 0082E9CC

Strings

Ex, xrefs: 0082E8AD
OO, xrefs: 0082E89F
|U, xrefs: 0082E8A6

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: Window$FindProcessThread
String ID: Ex$OO$|U
API String ID: 3928697162-1176901884
Opcode ID: a3e9f27785ae586a4b3600470abba2a752c334194804a4d386c08b9230840413
Instruction ID: 51d01ce8c0d428e1de163bb8482ceda7e471c1828b93eb33d1f459a1a23fb3e4
Opcode Fuzzy Hash: a3e9f27785ae586a4b3600470abba2a752c334194804a4d386c08b9230840413
Instruction Fuzzy Hash: B7B19D75600B10CFD724CF68E890B62B7F2FF59311F048968E59A8B7A1E778E841CB55

Function 008398F2 Relevance: 7.8, Strings: 6, Instructions: 303COMMON

Download Yara Rule

Strings

o$ , xrefs: 00839C7F
Y^S, xrefs: 00839ADD, 00839AF0
YRTP, xrefs: 00839C5E
#g>#, xrefs: 00839C95
UjcW, xrefs: 00839C53
$*- , xrefs: 00839C74

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Y^S$#g>#$$*- $UjcW$YRTP$o$
API String ID: 0-2638604102
Opcode ID: e2de5518220410d319e74b44a37425bd054e7982830f51421994812ef3f5f539
Instruction ID: 72c97f0d2b7841fe9852e42fb763943d1f4c4cdcdbb0436067f7d025d1cabd61
Opcode Fuzzy Hash: e2de5518220410d319e74b44a37425bd054e7982830f51421994812ef3f5f539
Instruction Fuzzy Hash: 14A12831A493918ED734CB6884913E7FBE1FF95350F099A6DC8D98B382C7709909D792

Function 0083702F Relevance: 7.0, Strings: 5, Instructions: 730COMMON

Download Yara Rule

Strings

i7b0, xrefs: 0083714F
InA>, xrefs: 008370D0
~x||, xrefs: 008370EF
:?-), xrefs: 0083715F
3768, xrefs: 00837157

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 3768$:?-)$InA>$i7b0$~x||
API String ID: 0-482665311
Opcode ID: 2e42fb99027e903eea1f75c4fbd1c33c6a6b06dda09ca5d034ab44cadca15af4
Instruction ID: b43fbaebb8401fc61e21d06d734a45722157948f4f5a3844d84a21ac4ffb97bf
Opcode Fuzzy Hash: 2e42fb99027e903eea1f75c4fbd1c33c6a6b06dda09ca5d034ab44cadca15af4
Instruction Fuzzy Hash: 3832F072A08315CFD324CF28D89062AB7E1FB99316F19896CE986D7391D739E911CB81

Function 0084F020 Relevance: 6.9, Strings: 5, Instructions: 644COMMON

Download Yara Rule

Strings

8977, xrefs: 0084F1BE
"#<, xrefs: 0084F154
f, xrefs: 0084F244
InA>, xrefs: 0084F0C0
InA>, xrefs: 0084F380

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: "#<$8977$InA>$InA>$f
API String ID: 2994545307-3216925240
Opcode ID: 9d07e60ec25edc50659b8dc978aaad3e00df9ce37dc4cfbcae3d73f4be9c74e2
Instruction ID: 15fed626a2c7a470aec48d546d215ff6c7bda093fd507cf2d77b75a278fc2c46
Opcode Fuzzy Hash: 9d07e60ec25edc50659b8dc978aaad3e00df9ce37dc4cfbcae3d73f4be9c74e2
Instruction Fuzzy Hash: 93229E716083459FC718CF29C890A2BBBE2FBD8314F198A2DE695C73A2D774D845CB52

Function 00811328 Relevance: 6.6, Strings: 5, Instructions: 387COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00811332
0123456789ABCDEFXP, xrefs: 00811328
gfff, xrefs: 00811F1F
gfff, xrefs: 00811F83
-, xrefs: 00811EE7

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 273f3b481aea1c1efff20954a37dab971126a2c25e53c4aad39b900e05bf82b0
Instruction ID: 3b45b8d0d23bee8e0a7fa9f36fe824f8731d69731b58ddcf08f87a9ba8b6e7ff
Opcode Fuzzy Hash: 273f3b481aea1c1efff20954a37dab971126a2c25e53c4aad39b900e05bf82b0
Instruction Fuzzy Hash: 8CE1A07160C7928FC715CE28C4802AAFBE5BFD9314F088A6DE9D9C7392D234D985CB52

Function 00836022 Relevance: 6.5, Strings: 5, Instructions: 224COMMON

Download Yara Rule

Strings

7, xrefs: 0083603C
, xrefs: 00836032
7, xrefs: 00836037
8, xrefs: 0083602D
W, xrefs: 008362BD

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $7$7$8$W
API String ID: 0-4210289531
Opcode ID: b996ac25122d3668557e5e51f17f3116868abeb281129c3070e488bd45287690
Instruction ID: ddced728ff0b9358f583569b1256877adc688d1edc0610a879f6e6033af7d54f
Opcode Fuzzy Hash: b996ac25122d3668557e5e51f17f3116868abeb281129c3070e488bd45287690
Instruction Fuzzy Hash: D481B67260C7848BD328CA3CC85535FBBD2ABD5324F198A2DD5E5C73C2D67988058742

Function 0082F0E6 Relevance: 6.3, APIs: 4, Instructions: 319threadwindowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,610963F7,?,00000000), ref: 0082F26E
GetWindowThreadProcessId.USER32(610963F7,00000000), ref: 0082F297
IsWindowEnabled.USER32(610963F7), ref: 0082F2AE
IsWindowVisible.USER32(610963F7), ref: 0082F2C5

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: Window$EnabledFindProcessThreadVisible
String ID:
API String ID: 3858996717-0
Opcode ID: 8d25488d341e47746466ebe0bad78d7ee30f7ddf0d0389a34909f2ebaa177c7a
Instruction ID: d5198cc423bc11a72da2494bcd115df3de8d6f816a6aaf4839cb30a2e7c75a87
Opcode Fuzzy Hash: 8d25488d341e47746466ebe0bad78d7ee30f7ddf0d0389a34909f2ebaa177c7a
Instruction Fuzzy Hash: 4BD19B71204B41CFC724CF29D491A26BBF2FF99314B19CA6DD49A8BB92D734E846CB50

Function 0083CBD0 Relevance: 5.6, Strings: 4, Instructions: 576COMMON

Download Yara Rule

Strings

`cPX, xrefs: 0083CDAE
8?, xrefs: 0083CE08
`;|9, xrefs: 0083CDFC
BcPX, xrefs: 0083CD71

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 8?$BcPX$`;|9$`cPX
API String ID: 0-3600580882
Opcode ID: 2db96d9796e3e8ae4d5f20177a947a72d22d7b8fa8c967d45c4c36147986f0e3
Instruction ID: 72ff2b1f632d05d97717b7e43d53294d36b8fef6edf36f5afa8552e5097defbd
Opcode Fuzzy Hash: 2db96d9796e3e8ae4d5f20177a947a72d22d7b8fa8c967d45c4c36147986f0e3
Instruction Fuzzy Hash: AAF1B9715083118FD724CF28D8917ABBBE1FFC1704F058A2CE9959B291E775994ACBC2

Function 00846D70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00846DB2
GetSystemMetrics.USER32 ref: 00846DC2

Strings

+DAM, xrefs: 00846EF9

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem
String ID: +DAM
API String ID: 4116985748-3236663638
Opcode ID: eafc4bd783601823d6d806b46ebb266865d65ea886fc1bb5d5c73075987c3fea
Instruction ID: 7d48849c8c145c98f38187a5466732455b2c55a2a6c9bf52e3fa5d8ea367fc1f
Opcode Fuzzy Hash: eafc4bd783601823d6d806b46ebb266865d65ea886fc1bb5d5c73075987c3fea
Instruction Fuzzy Hash: D69139B05097808FD770DF68D59979ABBE0BB8534AF10892DAA988B350DBB5944CCF43

Function 00A54246 Relevance: 5.4, Strings: 4, Instructions: 389COMMON

Download Yara Rule

Strings

", xrefs: 00932BC8
v, xrefs: 00A3654F
", xrefs: 00A542AD
E, xrefs: 00A10124

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "$"$E$v
API String ID: 0-4093480546
Opcode ID: 63b9863528d0d830c07fc7e7e9db8341a316157e1770ea2708c346feaaf0e792
Instruction ID: d77eadb3fd1acf64fc004c4a27bd7bd89f016b8cfaa66f4e73238d9c974517d4
Opcode Fuzzy Hash: 63b9863528d0d830c07fc7e7e9db8341a316157e1770ea2708c346feaaf0e792
Instruction Fuzzy Hash: BED175321187468FC319EF38E8454BAB3E2EBD5321F608A3ED59BC7495DB34551ACB81

Function 008408B1 Relevance: 5.3, Strings: 4, Instructions: 285COMMON

Download Yara Rule

Strings

lcw|<a, xrefs: 00841296
{{up, xrefs: 00840AC6
w|<a, xrefs: 0084124F
o~{q, xrefs: 00840ABF

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: lcw|<a$o~{q$w|<a${{up
API String ID: 0-3972657743
Opcode ID: a3ee45f8fd13257ef45653cfa78a7791ceabb930fda5a0ee638f2baaa6a07a8b
Instruction ID: d5b39a130e26a89f159e6d36e9d6c26ab715b8fe5b70d1b270e7a5c14020639c
Opcode Fuzzy Hash: a3ee45f8fd13257ef45653cfa78a7791ceabb930fda5a0ee638f2baaa6a07a8b
Instruction Fuzzy Hash: 68A14670204B468BE3258F28C891763FFA2FF95314F28865DD5A68B7D2D375E806CB91

Function 008E2B16 Relevance: 5.3, Strings: 4, Instructions: 253COMMON

Download Yara Rule

Strings

N, xrefs: 009A19F5
/, xrefs: 009A1A0D
*, xrefs: 00945F49
a, xrefs: 00A71E7A

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: *$/$N$a
API String ID: 0-3070520978
Opcode ID: 49491d817c235268ace403144eb7fe7d7f81d5fafc33542b70855fb29295c4c6
Instruction ID: 98c1a67680af7d9c9c553b30dde04207c94f9a74c61d29ffb67786ffca346fb7
Opcode Fuzzy Hash: 49491d817c235268ace403144eb7fe7d7f81d5fafc33542b70855fb29295c4c6
Instruction Fuzzy Hash: AA9197326087524BD718EF39E8521ABB3E1EBC5320F508B3DE896C72C5EB365919CB41

Function 008415DC Relevance: 4.3, Strings: 3, Instructions: 561COMMON

Download Yara Rule

Strings

]c\", xrefs: 00841649
NFFV, xrefs: 008419D9
>2%8, xrefs: 00841650

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: >2%8$NFFV$]c\"
API String ID: 0-36263332
Opcode ID: f4a1d707984ff1206412181518c64c1de78bf8979273f10b2549086785ef6119
Instruction ID: 4ef0f6dd6a59ed08cc9bc7bc29f5b99ff9f9b871fa6a47aa9a651f8131bc31c9
Opcode Fuzzy Hash: f4a1d707984ff1206412181518c64c1de78bf8979273f10b2549086785ef6119
Instruction Fuzzy Hash: DBF122705047828BDB258F2AC494722BFE2FFA3304F2C859DC4D68B796D7799886C761

Function 0082E07E Relevance: 4.3, Strings: 3, Instructions: 523COMMON

Download Yara Rule

Strings

Ex, xrefs: 0082E8AD
OO, xrefs: 0082E89F
|U, xrefs: 0082E8A6

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Ex$OO$|U
API String ID: 0-1176901884
Opcode ID: cb07d7e1271b9f775b0d914a4be6aebc22d6da5b43d58a3b1dd307b317a48ca5
Instruction ID: cfd3b03d06eab5066d04ef778a3b795f01631cce4f48080b07fffaed1690bea4
Opcode Fuzzy Hash: cb07d7e1271b9f775b0d914a4be6aebc22d6da5b43d58a3b1dd307b317a48ca5
Instruction Fuzzy Hash: 55F10474200B009FE7288F24D9D073777A2FB99315F64692CE697877A6D771E882CB48

Function 00852FB0 Relevance: 4.2, Strings: 3, Instructions: 492COMMON

Download Yara Rule

Strings

P, xrefs: 00853161
InA>, xrefs: 00853340
%*+(, xrefs: 008532D7

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %*+($InA>$P
API String ID: 0-1283304554
Opcode ID: 734d4d2247d1057ba692ffb5a0b08e7932ba4d453b9ad218238b06ebcbf80151
Instruction ID: 067f314f7eb1c3e91af75f3d33d6b3f37b1c47a43c2631d04d3fbf5f6f280b99
Opcode Fuzzy Hash: 734d4d2247d1057ba692ffb5a0b08e7932ba4d453b9ad218238b06ebcbf80151
Instruction Fuzzy Hash: E6F114726087648FC325CE28985036FB6E1FBC5755F15862CE9A9DB3D1CB70C90A8BC2

Function 0084C7A0 Relevance: 4.2, Strings: 3, Instructions: 441COMMON

Download Yara Rule

Strings

:, xrefs: 0084CCA6
Zk6i, xrefs: 0084C9F5
ho, xrefs: 0084CA15

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: :$Zk6i$ho
API String ID: 0-3802070491
Opcode ID: fd6467f21ca5be5c2aa0e11e37069c7279dac814dfafbff92f10dc4d7c19262f
Instruction ID: 5df015af52dd1a0d4033ae375c6cac88b5196ddf001926091c09474a1595d58d
Opcode Fuzzy Hash: fd6467f21ca5be5c2aa0e11e37069c7279dac814dfafbff92f10dc4d7c19262f
Instruction Fuzzy Hash: 3AD14736618316CBC7289F38E89126A77F2FF99352F09C87CD986C72A0E3789945C750

Function 00831100 Relevance: 4.1, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

j, xrefs: 00831390
[Y, xrefs: 008313BB
DE, xrefs: 00831341

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: DE$[Y$j
API String ID: 0-2398809664
Opcode ID: 79b9f7c85313b8afdab8d4a1d218de3070b726d4b100e021974276b10e1e4c2b
Instruction ID: 7d7b437eb9b24ab809b96c798f47f764a724a797da23de91896e4bb9641250da
Opcode Fuzzy Hash: 79b9f7c85313b8afdab8d4a1d218de3070b726d4b100e021974276b10e1e4c2b
Instruction Fuzzy Hash: 23B1CAB65083508FC704CF25D89566BBBE2FFD5318F09892CE4D98B351D7798908CB86

Function 0083F73A Relevance: 4.1, Strings: 3, Instructions: 323COMMON

Download Yara Rule

Strings

40,G, xrefs: 008410F7
L]IN, xrefs: 00840F6A
"MO, xrefs: 008411A5

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "MO$40,G$L]IN
API String ID: 0-2812748645
Opcode ID: a1f16c59e1393ffea0d503ba236f705c0e57a00ba46effc304ca049e0135c68c
Instruction ID: 214a3f3b3c622e5811be76de0b008d002525df2ea2771f5320e7f7a012a3bd28
Opcode Fuzzy Hash: a1f16c59e1393ffea0d503ba236f705c0e57a00ba46effc304ca049e0135c68c
Instruction Fuzzy Hash: 27A10470504B818BD725CF2AC490722BBE2FF96304F188A9DD4E68B786C779E446CB91

Function 00ABEC87 Relevance: 4.1, Strings: 3, Instructions: 309COMMON

Download Yara Rule

Strings

P, xrefs: 00ABECFE
V, xrefs: 00A97AE6
$, xrefs: 00A93129

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $$P$V
API String ID: 0-3262086503
Opcode ID: 049906a410e1633da42b1040bc0910c9693673d815abbf452b54a03907968e0b
Instruction ID: 1764eaa6295e749e9050d1e8a84a4ef9c753f30ee0914b24f84ac6d27fcdd84e
Opcode Fuzzy Hash: 049906a410e1633da42b1040bc0910c9693673d815abbf452b54a03907968e0b
Instruction Fuzzy Hash: EFA196341086428BD708EF39E8955BAB3E2FBD1310F64DB3ED596CB5D0E639841ACB41

Function 00840887 Relevance: 4.0, Strings: 3, Instructions: 297COMMON

Download Yara Rule

Strings

40,G, xrefs: 008410F7
L]IN, xrefs: 00840F6A
"MO, xrefs: 008411A5

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "MO$40,G$L]IN
API String ID: 0-2812748645
Opcode ID: 3d9bca0b79bf589dc9ad82bd0398e22ad7b035a9a2cf53393188ee7ab38cef32
Instruction ID: 121f9cd0a453b930db69da4e0b1e7f35ba8d03ac5a0b5e5809513d361378d913
Opcode Fuzzy Hash: 3d9bca0b79bf589dc9ad82bd0398e22ad7b035a9a2cf53393188ee7ab38cef32
Instruction Fuzzy Hash: 8D91E371504B818FD7258F2AC490722BBE2FFA6304F18CA9DD4D68F746C7799446CBA1

Function 00838290 Relevance: 4.0, Strings: 3, Instructions: 296COMMON

Download Yara Rule

Strings

hv, xrefs: 008380AF
45, xrefs: 008382EB
(, xrefs: 008380B6

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ($45$hv
API String ID: 0-1388148980
Opcode ID: 0f3db49629d03c6d377f732191103d5550ebb978d5bd0239c8d927d5f5101e70
Instruction ID: 73fa36ab4757131561835640414a9438f11297d6ef470638cd044c1d9ea92def
Opcode Fuzzy Hash: 0f3db49629d03c6d377f732191103d5550ebb978d5bd0239c8d927d5f5101e70
Instruction Fuzzy Hash: A4911376944348DBEB20CFA9DC81BDFBBB4FF85304F144168E954AB281D7749906CB92

Function 00840F3E Relevance: 4.0, Strings: 3, Instructions: 286COMMON

Download Yara Rule

Strings

40,G, xrefs: 008410F7
L]IN, xrefs: 00840F6A
"MO, xrefs: 008411A5

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "MO$40,G$L]IN
API String ID: 0-2812748645
Opcode ID: 4efc055a5ac1feec7e15c237ba47f01ae4e8e1d4ea70f7c4910d91da9c8dac11
Instruction ID: f76c8379a5fa54cbccbc541204621dff99dcf5232b3093b7c44884a179b81f4d
Opcode Fuzzy Hash: 4efc055a5ac1feec7e15c237ba47f01ae4e8e1d4ea70f7c4910d91da9c8dac11
Instruction Fuzzy Hash: 8881E271504B818FD725CF2AC490722BBE2FF96304F18869DD4E68F786C779A446CBA1

Function 00A76F37 Relevance: 4.0, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

*, xrefs: 00AC1D12
%)u, xrefs: 00A233FB
C, xrefs: 00A7703A

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %)u$*$C
API String ID: 0-4095948065
Opcode ID: 29f9ade870d4c5dd855a6d7a2ef875bcb6001d9064221ff3d0e9840bdd36cdcb
Instruction ID: 68701cf912e25bd808a9e8e2cb49ce1892517fb51fee1a012f0067d23dccdb93
Opcode Fuzzy Hash: 29f9ade870d4c5dd855a6d7a2ef875bcb6001d9064221ff3d0e9840bdd36cdcb
Instruction Fuzzy Hash: 9961BB766186154BD71CEE28D8825FB73D2E7C5300F10873CA9D787A91DB39581B8B86

Function 00C24322 Relevance: 4.0, Strings: 3, Instructions: 222COMMON

Download Yara Rule

Strings

D, xrefs: 00BF60EF
9^5O, xrefs: 0105AEF3
!, xrefs: 00BF60D8

Memory Dump Source

Source File: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !$9^5O$D
API String ID: 0-4080017824
Opcode ID: 20e4adaeaa21867ce57fa1f42d4f6bf8963a711376363d7f46745dc12e405111
Instruction ID: ee039b6d9728f49f9426e084902949907688b62779468b57be12f786dfe4bf1d
Opcode Fuzzy Hash: 20e4adaeaa21867ce57fa1f42d4f6bf8963a711376363d7f46745dc12e405111
Instruction Fuzzy Hash: 368186325087468BC718EA3CD8815FAB3A2EBC1321F648B7DD5A2C71D1E73955299B81

Function 009C58AD Relevance: 3.9, Strings: 3, Instructions: 188COMMON

Download Yara Rule

Strings

, xrefs: 0094CD5A
4, xrefs: 009C58E9
3, xrefs: 0094CD42

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $3$4
API String ID: 0-3737300650
Opcode ID: 4a1564405dab0b556f6a8a7944ec72b47c3ac9743a8ad8bc16009548e828f7bd
Instruction ID: 667584834774985f3c99a2bd607d3ecc08143d67dd2a06b69028aed1264680c2
Opcode Fuzzy Hash: 4a1564405dab0b556f6a8a7944ec72b47c3ac9743a8ad8bc16009548e828f7bd
Instruction Fuzzy Hash: 40617A765087168BD71CEF78E8426EAB3A1FBC1350F20893D9586C70D1EB3A651ACA85

Function 00AF77AB Relevance: 3.9, Strings: 3, Instructions: 137COMMON

Download Yara Rule

Strings

.+<$, xrefs: 00ADA3AF
t, xrefs: 00AF77E3
g, xrefs: 00ADF67B

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: .+<$$g$t
API String ID: 0-3352640822
Opcode ID: 64488aa3021a9e1df8b7d24a00fd1f45e6aa83698e9d11cc241e4b0eede1f783
Instruction ID: 797898c8f2ca600e5b4033a915956be4e3377ff0774f27594b1ada39a997c00d
Opcode Fuzzy Hash: 64488aa3021a9e1df8b7d24a00fd1f45e6aa83698e9d11cc241e4b0eede1f783
Instruction Fuzzy Hash: 234165366087028BC728EF28CC425E673E2FBD5320F54CA3DA497971D9DB39940A8A81

Function 0083F9D0 Relevance: 3.8, Strings: 2, Instructions: 1324COMMON

Download Yara Rule

Strings

a|cI, xrefs: 00840620
\X"Q, xrefs: 00840619

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \X"Q$a|cI
API String ID: 0-3233608862
Opcode ID: 585b587c8aa6ec5e54755f5e0ef66b683f7db1df9986a6a137bc00b2a174b6b7
Instruction ID: 5801af6b7925e957a27c98ae4ff8b9d36c22d41fe03d2f41437070eb318d569c
Opcode Fuzzy Hash: 585b587c8aa6ec5e54755f5e0ef66b683f7db1df9986a6a137bc00b2a174b6b7
Instruction Fuzzy Hash: 129215716047818FD7298F39C490762BBE2FF96314F2885ADC5D68B7A2C779D806CB90

Function 00832520 Relevance: 3.2, Strings: 2, Instructions: 672COMMON

Download Yara Rule

Strings

c], xrefs: 00832537
$96w, xrefs: 00832730

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: $96w$c]
API String ID: 2994545307-247510824
Opcode ID: 83e623e969bb45af8938971cfb20e74e8997be53f7bd6ec52aa676b80ee28838
Instruction ID: 912e46fa49c6738bdef9e5c7c69a044dc8e11e1bef743b2380edd56ccf032c64
Opcode Fuzzy Hash: 83e623e969bb45af8938971cfb20e74e8997be53f7bd6ec52aa676b80ee28838
Instruction Fuzzy Hash: 3422EF716083459BD724CF28C881B6BBBE2FBD4714F14892DE989CB391E771E845CB92

Function 00A152F3 Relevance: 3.1, Strings: 2, Instructions: 613COMMON

Download Yara Rule

Strings

N, xrefs: 00996E60
-, xrefs: 00996EB8

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -$N
API String ID: 0-2941813136
Opcode ID: bbc7aefe540ffdb81cf593d264b936a1ce055b5ce08baef93efd99ba6ca525d9
Instruction ID: 27da35950d587f598f5519f0cefb57a1aa32e0b053cb6964010e6cad6313282f
Opcode Fuzzy Hash: bbc7aefe540ffdb81cf593d264b936a1ce055b5ce08baef93efd99ba6ca525d9
Instruction Fuzzy Hash: D82278361087128FD718EB38D8515EAB7E2EFD5310F248A7DE095CB2D6E775940ACB42

Function 008330E0 Relevance: 3.0, Strings: 2, Instructions: 466COMMON

Download Yara Rule

Strings

c, xrefs: 00833550
`, xrefs: 00833126

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: `$c
API String ID: 0-1220095849
Opcode ID: 8181126251d3da1030b104880d9b52217af420fd823694233c43dcefb657ed64
Instruction ID: 1e3427f413e23ef86d266e69926ec633abfaa46d4bc15fd17c7987a7fb8d0af5
Opcode Fuzzy Hash: 8181126251d3da1030b104880d9b52217af420fd823694233c43dcefb657ed64
Instruction Fuzzy Hash: 58D1D371A08340ABD7019F25D882BAFBBE9EFD6714F18882DF88497281D674DD468793

Function 0083D2FD Relevance: 3.0, Strings: 2, Instructions: 457COMMON

Download Yara Rule

Strings

ZDRW, xrefs: 0083D310
RLjo, xrefs: 0083D320

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: RLjo$ZDRW
API String ID: 0-2283519047
Opcode ID: aaf79765dd0467ae01feb0986f447b33a09decf859940e103ffab7c6d3a1a655
Instruction ID: 8e41f3f47b702c5ec90d82638496ff036e8800ab6a26b384489156e0b161f289
Opcode Fuzzy Hash: aaf79765dd0467ae01feb0986f447b33a09decf859940e103ffab7c6d3a1a655
Instruction Fuzzy Hash: 8AD1E0B19083449FC714DF68E8826ABBBF5FF95305F04882CE59987362E7789845CB87

Function 00AEF608 Relevance: 2.9, Strings: 2, Instructions: 413COMMON

Download Yara Rule

Strings

w, xrefs: 00AEF6B2
a, xrefs: 00AEF62A

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: a$w
API String ID: 0-2312994108
Opcode ID: c09c7c57ccbc161631ae39b3c114cef8d75de262eaefe6a71c12c626707ad353
Instruction ID: 4e3005bed1961f00eaa78a3910a70e0b3bbb31ceacddc9a04ce63ee7bc2e5989
Opcode Fuzzy Hash: c09c7c57ccbc161631ae39b3c114cef8d75de262eaefe6a71c12c626707ad353
Instruction Fuzzy Hash: 23F1B9352087528BD708EF3CE4905ABB7E2FBC5324F608A7DD09AC7299D735651ACB41

Function 00813930 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

NaN, xrefs: 0081398A
Inf, xrefs: 00813983

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: fa3763592639e4481ba8536763ebf0f3cb4cf22468bce1ae70b4d22ff4a17de4
Instruction ID: 4e39395db0f429b519fb4e08cc76701aa5b3475521bd10c6639ee4968394ccf6
Opcode Fuzzy Hash: fa3763592639e4481ba8536763ebf0f3cb4cf22468bce1ae70b4d22ff4a17de4
Instruction Fuzzy Hash: 4FD1B471A083159BC704CF28C88169ABBE9FFC4750F158A2DE899D7394E771DD858BC2

Function 0082104F Relevance: 2.9, APIs: 2, Instructions: 377COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 00821378
CoUninitialize.OLE32 ref: 008214A8

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 15c1a32400b6995d115226bc4099083d3344fa75cdea499954b5fc624d34bbad
Instruction ID: fdee3d7cd62d1a430ec926e4ea406c80b2ce2cd07d3499a9ae4ab348822d6bfc
Opcode Fuzzy Hash: 15c1a32400b6995d115226bc4099083d3344fa75cdea499954b5fc624d34bbad
Instruction Fuzzy Hash: ECB12AB5A007409BD714AB38AC9276BB6A6FFD5314F08853CE84787783DB39E4458793

Function 00AF7B60 Relevance: 2.9, Strings: 2, Instructions: 354COMMON

Download Yara Rule

Strings

#%v, xrefs: 00AF7C36
0, xrefs: 00AF7D09

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: #%v$0
API String ID: 0-4099513283
Opcode ID: c79e2c092ad8416d6ddb60784603206328bb62481e5112320e1e981ba9035140
Instruction ID: 3ce51b8b769d66cabf5607c99f977325a9ac8154942fd961b6fc338169d130c5
Opcode Fuzzy Hash: c79e2c092ad8416d6ddb60784603206328bb62481e5112320e1e981ba9035140
Instruction Fuzzy Hash: 4DB1FB352286268BD71CEB2CE8818BA73D2FBD1324F20C77DE583C7989D73558078A81

Function 00852700 Relevance: 2.8, Strings: 2, Instructions: 347COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008528C7
%*+(, xrefs: 00852737

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($%*+(
API String ID: 2994545307-3039692684
Opcode ID: 8f673244a15b4a3d7393f1f0ab270aee0bc1cc293d69507d75437732bee1a1c2
Instruction ID: 3eef12b3b12ec102c9f816d3e346e178d250ca9dff4bfafc94cf2a492f4c8ae7
Opcode Fuzzy Hash: 8f673244a15b4a3d7393f1f0ab270aee0bc1cc293d69507d75437732bee1a1c2
Instruction Fuzzy Hash: A7A105316083215BD738CA68CC81BABB7E1FB8A315F14893DED95D7392EE3098458B52

Function 00839328 Relevance: 2.8, Strings: 2, Instructions: 339COMMON

Download Yara Rule

Strings

5L, xrefs: 00839398
_], xrefs: 0083948B

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 5L$_]
API String ID: 0-2033130362
Opcode ID: 83224abab4c22919b6cea034b5242519c172c3da35e8f3043ec456ec327fc357
Instruction ID: af500489b1566213cc0202d9bc565acf79c9945522c7dde407ec7a91e31fa259
Opcode Fuzzy Hash: 83224abab4c22919b6cea034b5242519c172c3da35e8f3043ec456ec327fc357
Instruction Fuzzy Hash: A2B1E172A18712CBC724CF28C4911ABB3F2FFD8754F19892CD8C58B264E7B49946CB91

Function 008E1696 Relevance: 2.8, Strings: 2, Instructions: 336COMMON

Download Yara Rule

Strings

E, xrefs: 009C0DD4
C, xrefs: 008B576B

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: C$E
API String ID: 0-2059648562
Opcode ID: 5bf176f52e4322211afcd9810f541ef6345f721fa75988b5bfb96024fc671a05
Instruction ID: 06a598d4e79ce5b776b938afaf875d40e9aa83e837956eddf459721e460c8a3f
Opcode Fuzzy Hash: 5bf176f52e4322211afcd9810f541ef6345f721fa75988b5bfb96024fc671a05
Instruction Fuzzy Hash: 6EC1DB316082268FC318EF28D8506FA73E2FBD5314F55863DE196CB1C5EB35951ACB80

Function 00A64141 Relevance: 2.8, Strings: 2, Instructions: 326COMMON

Download Yara Rule

Strings

6, xrefs: 00A642AA
1, xrefs: 009626E4

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 1$6
API String ID: 0-3837403786
Opcode ID: ff210be6d71df849f690df41db86e5df1b341b7e49f4c7a55e040dac149f336b
Instruction ID: a928555038279886b79eb774336f4d562a0299c15e7e40da7d9eac9a1e2589f2
Opcode Fuzzy Hash: ff210be6d71df849f690df41db86e5df1b341b7e49f4c7a55e040dac149f336b
Instruction Fuzzy Hash: 31A1BA72518B168BC31CEF6CD8858E6B396EBD9311B20C76DD486CB1D6DB35980BCA84

Function 008114A8 Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 008114B2
0123456789ABCDEFXP, xrefs: 008114A8

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEFXP$0123456789abcdefxp
API String ID: 0-595753566
Opcode ID: 82447d291205baa88b5a57d9a87973b623c065947e16f969f36a84c3bba52d5c
Instruction ID: 974254e425181c96fd49b605b7a021c9de8ae618ad78d79e45c9b0a53c6fda32
Opcode Fuzzy Hash: 82447d291205baa88b5a57d9a87973b623c065947e16f969f36a84c3bba52d5c
Instruction Fuzzy Hash: 64A1AF31A0C3868BDB18CE24C0843AEBBE6FFD5318F14896DE5D597391D3759989CB82

Function 00819FF5 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

0, xrefs: 00819C7D
8, xrefs: 00819C75

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: c9481420fd3cd332aba14c09f3afdf92192e5cc49ef9c73813563d251fef520c
Instruction ID: 824c7325fb3eedf71a57f82235c25dd860277f7c09a40e5f1dea624afb412b7b
Opcode Fuzzy Hash: c9481420fd3cd332aba14c09f3afdf92192e5cc49ef9c73813563d251fef520c
Instruction Fuzzy Hash: 14C11131209384EFCB158F68C840A9EBBE1BF99354F04891DF9C897261D37AD958DB92

Function 008214CE Relevance: 2.8, Strings: 2, Instructions: 258COMMON

Download Yara Rule

Strings

Noni, xrefs: 0082159E
f[zU, xrefs: 00821589

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Noni$f[zU
API String ID: 0-2312422219
Opcode ID: a520e002fb87bdf241d6f35e93c6aad7708eb1382dc84332bba4bdb5b0e305b4
Instruction ID: f134e984e07ebaf69131380e4d01066e159d9a06e45b5e22fb07bc18e024549d
Opcode Fuzzy Hash: a520e002fb87bdf241d6f35e93c6aad7708eb1382dc84332bba4bdb5b0e305b4
Instruction Fuzzy Hash: 6491DBB01443108BEB289F24D9D57263BB2FF65304F24958CD9464F7AAD7B6E882CF85

Function 008EC77F Relevance: 2.7, Strings: 2, Instructions: 245COMMON

Download Yara Rule

Strings

9, xrefs: 00AB629B
c, xrefs: 009E4F09

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 9$c
API String ID: 0-4054373961
Opcode ID: 3407328aed204039311caf6412ee87210c0f92e73492d10d44b613e552107daa
Instruction ID: 421f624dde5d82edb2fbabba9a0f7b356842f19de657dd92a629bba194381f88
Opcode Fuzzy Hash: 3407328aed204039311caf6412ee87210c0f92e73492d10d44b613e552107daa
Instruction Fuzzy Hash: 8D71DB32558A4A4BC718EB299C855BB73D2FBC9301F54863DC4CB8B585EB3269078B82

Function 00A26891 Relevance: 2.7, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

f, xrefs: 00937493
', xrefs: 00A466B2

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: '$f
API String ID: 0-2541399228
Opcode ID: 0a41ce47058c4aa00a9425d40f8356edb57aaf4573480ad19e546e6fffe30786
Instruction ID: 41ab50ec6e77208c82809dc037f8b910948efa4fca92cc0a64c1eca61e5b1323
Opcode Fuzzy Hash: 0a41ce47058c4aa00a9425d40f8356edb57aaf4573480ad19e546e6fffe30786
Instruction Fuzzy Hash: 6561BC35118A154BE70CEB3CE8658FBB3D2EBC5320FA18B6ED056C71D6DB75950ACA40

Function 00883111 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

\, xrefs: 00B07B05
", xrefs: 00B07B0A

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "$\
API String ID: 0-1472051173
Opcode ID: 059fb2b34d287a1b9fe1e2b5162cdb6421823d85dcf0eb15d4059fc5b504e5bd
Instruction ID: a54fe4ccbac1274c16b0c738ecdc7503627e0b5d3d7390018f51371a3b8b8bdb
Opcode Fuzzy Hash: 059fb2b34d287a1b9fe1e2b5162cdb6421823d85dcf0eb15d4059fc5b504e5bd
Instruction Fuzzy Hash: 1B51AC3261C7124BD31CEF2DD9451ABB3D1EBD6311F20CA3DD4D78B186DA3554078A86

Function 0095849A Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

Y, xrefs: 00A885BF
2#$s, xrefs: 00A88630

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2#$s$Y
API String ID: 0-3836326983
Opcode ID: 78132b46f65b1cf359cc5b930a741779072d6b1c1376b801f7c5374540ee300f
Instruction ID: 227abde962eda1a22aa2ef46f67a9f3b6c1b58a15dbd2a523b53c093b886e752
Opcode Fuzzy Hash: 78132b46f65b1cf359cc5b930a741779072d6b1c1376b801f7c5374540ee300f
Instruction Fuzzy Hash: 4E618A326087558BC718EE2EE4514BAB7E2FBC5310F54CA3EE48BC75D4DB3458868782

Function 0095A9AE Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

{, xrefs: 0095A9DC
,, xrefs: 0095A9E1

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,${
API String ID: 0-4163448708
Opcode ID: 93915f48d0f6cb1b48c281ea2b7cdda2c767766c2919450ec20d4243614ae65d
Instruction ID: 62dde106462d230e84a587598ed19014bf2afaa6d9761d0ad83753f8fec33e2b
Opcode Fuzzy Hash: 93915f48d0f6cb1b48c281ea2b7cdda2c767766c2919450ec20d4243614ae65d
Instruction Fuzzy Hash: 035166765087128BD30DEB38D8508EA73E2EBD2320F55C73DD1A28B5D5DB35651AC740

Function 00A76274 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

V, xrefs: 00AF3327
3, xrefs: 00AF331F

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 3$V
API String ID: 0-2861340604
Opcode ID: e38f2bc7ae078b359e96866e7745e3e5cdc40521349cd1aaecc1a4e55e897d4d
Instruction ID: d64cd0b6ebb11b1b5b3cc67bc4545d455d60fc1aae29f3be850bcaf470639706
Opcode Fuzzy Hash: e38f2bc7ae078b359e96866e7745e3e5cdc40521349cd1aaecc1a4e55e897d4d
Instruction Fuzzy Hash: DD5156321183068BDB1CEB28E4118EBB7E1EFC5324F618B3DD097C7998E3355156DA01

Function 0087116C Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

9j, xrefs: 00A90404
,I, xrefs: 00A9040E

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 9j$,I
API String ID: 0-3422571232
Opcode ID: 2e0a1e951e35272bc20ed8c17814aa6548d143998e2e43eed9c86ad8466003c8
Instruction ID: 657b9f208f023ee5b8a3a500735cd368ac8bd8af20d1eaada861eccde9b51bb7
Opcode Fuzzy Hash: 2e0a1e951e35272bc20ed8c17814aa6548d143998e2e43eed9c86ad8466003c8
Instruction Fuzzy Hash: 1C4111266041260BDB0CEA34C8625FB77E3EBC5350F94D23E9987CF586EA38451AC780

Function 0082D010 Relevance: 2.0, Strings: 1, Instructions: 715COMMON

Download Yara Rule

Strings

_a c, xrefs: 0082D3A6

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: _a c
API String ID: 0-3120592319
Opcode ID: 2ea076422d15f259e46f1fbe6819640968266f22eeb3074827892102761bc453
Instruction ID: 0e811466973837f6aec38d72f7bf60a7a544fa179eab1a77d798e4cff8a64668
Opcode Fuzzy Hash: 2ea076422d15f259e46f1fbe6819640968266f22eeb3074827892102761bc453
Instruction Fuzzy Hash: 1B12DFB0600B109FD7249F39D9827A37BF5FF45314F144A2DE89A8B791E334A845CB92

Function 0082CFFF Relevance: 2.0, Strings: 1, Instructions: 714COMMON

Download Yara Rule

Strings

_a c, xrefs: 0082D3A6

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: _a c
API String ID: 0-3120592319
Opcode ID: aa8d2a174cf78a4ef7b8da4f8d16818e51647d57595c55f9a3c8001e9ea88b78
Instruction ID: d87b54689a0d34195d1aa29ab65875cfae5c5e1f8e6f7b67520effb15694a4ca
Opcode Fuzzy Hash: aa8d2a174cf78a4ef7b8da4f8d16818e51647d57595c55f9a3c8001e9ea88b78
Instruction Fuzzy Hash: 0E12E1B0600B109FD7249F39D9827637BF4FF45314F144A2DE89A8B795E334A855CB92

Function 00815000 Relevance: 1.8, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 008153BF

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 7e9c932a37836e83150f89e328236420ec33deca25beee19d50350f01dbd34f2
Instruction ID: 951c7fc816c5fced4fd325e71cabdd2f747a691b30adde0f038d79d4ba12f8e7
Opcode Fuzzy Hash: 7e9c932a37836e83150f89e328236420ec33deca25beee19d50350f01dbd34f2
Instruction Fuzzy Hash: 1F12D7B2A04B41CBE7158E18D4803AAB7D6FFE1318F19856DD8A9CB351E7B1DC85C781

Function 0083ECE0 Relevance: 1.7, Strings: 1, Instructions: 422COMMON

Download Yara Rule

Strings

", xrefs: 0083EFF6

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 27efb59d8c3a42815183dfd79f844d8e56b1619eee6eb80f319402ff221c0e9a
Instruction ID: ed1fbf0cfdc88a2a5117d64d3234435721a7744d8a182d9705b932fd5697b741
Opcode Fuzzy Hash: 27efb59d8c3a42815183dfd79f844d8e56b1619eee6eb80f319402ff221c0e9a
Instruction Fuzzy Hash: 05D1D2B2A083149BD725CE28C89176BB7E9FBD4314F18896DE989C7382E734DD4487D2

Function 00831EC5 Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

_a1c, xrefs: 0083203B

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: _a1c
API String ID: 0-3923334831
Opcode ID: ff8ab369c70a7380ad1d9f91ca6d98d25b54fac2f3efb36ce3647e6a5f456fa3
Instruction ID: 6d822f1a2e5d46b95202eb3ae1fac8df0a5334ab5bba7d5c4e292adc449255e4
Opcode Fuzzy Hash: ff8ab369c70a7380ad1d9f91ca6d98d25b54fac2f3efb36ce3647e6a5f456fa3
Instruction Fuzzy Hash: CBC1FDB55093018BD7108F28C89136BBBE2FFD6754F188A1CE4C49B3A5E7798942CB86

Function 00A10E39 Relevance: 1.6, Strings: 1, Instructions: 374COMMON

Download Yara Rule

Strings

g, xrefs: 00ADF67B

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: 662c18780bd62e4af2d04acc1e89b7fe989686818ca90a4d860c257bc60228ee
Instruction ID: 66bf39808326ee2a50b938e8f533396a69c720b29cefd4ecf0ca4a8508491cd8
Opcode Fuzzy Hash: 662c18780bd62e4af2d04acc1e89b7fe989686818ca90a4d860c257bc60228ee
Instruction Fuzzy Hash: 24C1BA72608A168BD30CDE3888915BBB392FBC5320F50DB3DD59BC76D5DB35A8068B81

Function 00D14CBE Relevance: 1.6, Strings: 1, Instructions: 371COMMON

Download Yara Rule

Strings

, xrefs: 00BA3200

Memory Dump Source

Source File: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b76b8c449249f83d27fdc07eb7d515364c1f19ee1d024c38be8de42568a512a5
Instruction ID: 4be50677bc06411aa8cd446ee988ced4aaa86ae995ea6d2843f3811a82f3b8be
Opcode Fuzzy Hash: b76b8c449249f83d27fdc07eb7d515364c1f19ee1d024c38be8de42568a512a5
Instruction Fuzzy Hash: 03B1FE3250C6569BC709DF29D8814E6B7E2EBD6720F1487ADE49A8B282DB319907C781

Function 00C43BD6 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

9, xrefs: 00BEDFA6

Memory Dump Source

Source File: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 8b6b3e7c72407bfd707bb24f12de45131bfba6c402101768cbf744ef1dda1027
Instruction ID: f19d449e8b50ce5c2b03caa389feae3412d5ae0f1dde931989aabcc743ea562d
Opcode Fuzzy Hash: 8b6b3e7c72407bfd707bb24f12de45131bfba6c402101768cbf744ef1dda1027
Instruction Fuzzy Hash: D6B1EA324087268BD32DDF29D8854E2B3D2FBC5314FA08A6DD486CB195EB75651BCBC1

Function 00852B10 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

8977, xrefs: 00852B12

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 8977
API String ID: 0-400282742
Opcode ID: abc49db73c8cd7c196f85d62b5a9929a8828bb3af80955749a2e31bacc4da5a5
Instruction ID: 35d4ac066d9ce6a1e6d30f8b349b3c34b15ce427f336825c4b4c7fddad5eac5f
Opcode Fuzzy Hash: abc49db73c8cd7c196f85d62b5a9929a8828bb3af80955749a2e31bacc4da5a5
Instruction Fuzzy Hash: 68A12072A043115BE724DF288C8176BB7EAFBC6715F09492CED95D3252EE34EC098792

Function 008A53B3 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

g, xrefs: 00ADF67B

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: 825eb8cd2197169fd021972528d33b0163a2748db2831c5c44427dce3fcd8fbf
Instruction ID: 932340bfec745dfb79c381f58031e6844eef20a2ec4de0f958190ee847e81e48
Opcode Fuzzy Hash: 825eb8cd2197169fd021972528d33b0163a2748db2831c5c44427dce3fcd8fbf
Instruction Fuzzy Hash: AE91D676918A0E8BC31CDA29D8425F673D2FBC6320F50873EDAC7C76D6DA3494078685

Function 00A8BEE8 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

d, xrefs: 00A588FA

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 838b0a382ffe5e676b9f04141742db17a8f3b45969d84c20f84fee9b62dee7d9
Instruction ID: ac3db12fb38b3dca6d8f7b3a102bfa753ca4de2f4f9e4a5bf93affad370bb851
Opcode Fuzzy Hash: 838b0a382ffe5e676b9f04141742db17a8f3b45969d84c20f84fee9b62dee7d9
Instruction Fuzzy Hash: 70A199326186028BD71CEF69C8914F673E2FBD5310B20863EE597C75D9E735A80ACB80

Function 0102019A Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

+, xrefs: 00BC188C

Memory Dump Source

Source File: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 8930c45f54abed4365ec277d1fe40fa223eafea0524f82829753c976bce43376
Instruction ID: bf83cc3a417a6bbd8c14a08cec79ca29681c5d160ab8e318c1050e5ee39b825d
Opcode Fuzzy Hash: 8930c45f54abed4365ec277d1fe40fa223eafea0524f82829753c976bce43376
Instruction Fuzzy Hash: 9F91B93121C6468BC31CEB28D8926FAB3E5EBC5304F508A3DD4DB871C2DB39940ACB45

Function 009CBE92 Relevance: 1.5, Strings: 1, Instructions: 275COMMON

Download Yara Rule

Strings

&, xrefs: 009CBF3F

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 19c4b26c89a4a7cf2fe727ee5b5af5047d9a18887c45403fdf6f0112a4b567ba
Instruction ID: ed390ea19045790e782f32ba376418ba2e98ba6a569afe7e282123615fad376c
Opcode Fuzzy Hash: 19c4b26c89a4a7cf2fe727ee5b5af5047d9a18887c45403fdf6f0112a4b567ba
Instruction Fuzzy Hash: 81A165361186078BC328EF28E9514FAB3A1EBC5311F648B3ED59BCB2D5EB395116CB41

Function 0102CEA4 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

L, xrefs: 00FF4884

Memory Dump Source

Source File: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: ad359a785ea39deef6ca4860b465ffe2e6c146bc478d2c3d91ef7c56a50c9739
Instruction ID: e7f6a108117c417758d587b25f0c1b2921c536b9ac30b432ec25c60f9d658982
Opcode Fuzzy Hash: ad359a785ea39deef6ca4860b465ffe2e6c146bc478d2c3d91ef7c56a50c9739
Instruction Fuzzy Hash: 919199356087A64BC318EA29D8501FBB7D2EBC5320F14CA3EE59AC76C4E779950ACB41

Function 0084FC90 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

InA>, xrefs: 0084FD10

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: InA>
API String ID: 2994545307-2903657838
Opcode ID: 323054061acfba6d55710e5513f906b886c664c39d1a2e7966224f86c0f8aff0
Instruction ID: ab0348c1dc9a5172a745e4ba763ebabf18b3255d77791f06676b0df25a5f875c
Opcode Fuzzy Hash: 323054061acfba6d55710e5513f906b886c664c39d1a2e7966224f86c0f8aff0
Instruction Fuzzy Hash: C0610331A4830D5BD724DE68CD8072AB7E2FBC8315F24893CE795CB2A7E6719C058B55

Function 00945211 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

:, xrefs: 0094523C

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 8f8f55a4e0df3e7d9dddf5bfcdac3a63175fb32b6bcb7e7bc2bb9181dbd04b54
Instruction ID: da9b706cfd06283096c5eee6f4de371fd8b0a36497d3a6b837637c3e61485f9c
Opcode Fuzzy Hash: 8f8f55a4e0df3e7d9dddf5bfcdac3a63175fb32b6bcb7e7bc2bb9181dbd04b54
Instruction Fuzzy Hash: E271ED31128A2A4BC308EA6CE4558F677D1EBD5330F64877DE8E6C3596DB29891B8B40

Function 008524E0 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

8977, xrefs: 008524E2

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 8977
API String ID: 0-400282742
Opcode ID: 1f97ad247acdc184c32ab437ac0412dc111277914a3e17bb8d316b24eed2eb90
Instruction ID: 118e3c543f47d42822139db4370b81d77f48bf885597794c6b92bdc5dc419165
Opcode Fuzzy Hash: 1f97ad247acdc184c32ab437ac0412dc111277914a3e17bb8d316b24eed2eb90
Instruction Fuzzy Hash: EB5168327042155BD7289A2C8D9172B77D2FBD6325F29863CED95DB3D2EE30AC098780

Function 009A7A37 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

!, xrefs: 00AF08C8

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 252747a86d085a06517e30845793d465095e7e7a43fa955f369434e1570d7b6f
Instruction ID: 423419dc29178f39119d805ecb4a1ec988ca38113ff71b304d4f76643a90a519
Opcode Fuzzy Hash: 252747a86d085a06517e30845793d465095e7e7a43fa955f369434e1570d7b6f
Instruction Fuzzy Hash: 9561DE3131870A8BC32DAA28D8558B673D2EBC6325F64877ED593CB1D1DF259807CA82

Function 0081DF60 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0081E12B

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 1a7013a717b4bb1d9b77f72a5c60182c754e598da45e75f3bae4b8cd3d574cad
Instruction ID: e9580caabefce1027841b54af59c472a55e7adc50f125d8bbc51db22f2f7ef3b
Opcode Fuzzy Hash: 1a7013a717b4bb1d9b77f72a5c60182c754e598da45e75f3bae4b8cd3d574cad
Instruction Fuzzy Hash: 9B514933E19AA45BC714893C4C012E97A5BBFD6334B2DC3A6EDB1DB3D5C96A8D424390

Function 00A35ABF Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

A, xrefs: 00A35BE4

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 01ef76c55d3958c6c6cbac73f8579a879ec0cea57fc3bff16ccb6fb0b6b65a38
Instruction ID: 4ea53476c06e5db6e40525bb5c1b918962b5afb92e973486b650856173ccfdf8
Opcode Fuzzy Hash: 01ef76c55d3958c6c6cbac73f8579a879ec0cea57fc3bff16ccb6fb0b6b65a38
Instruction Fuzzy Hash: 7861A6392082578BC71DEE3CA4815FA7392EBC5311F688A3DD19BC71D8DB38641AC701

Function 009A5F0F Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

g, xrefs: 00ADF67B

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: 3d626501c55585c8dd8ff55657c258d9c3b56e003792bcaff9b25c5134800397
Instruction ID: cf362855e71575e8cae91dceab203d14f17c3858f4eb39cd4fc4dd4ff5894628
Opcode Fuzzy Hash: 3d626501c55585c8dd8ff55657c258d9c3b56e003792bcaff9b25c5134800397
Instruction Fuzzy Hash: F551DA36514A268BD31CD92C88A21F6B386F7C6321F44823ED55BC76D9EF79A5068280

Function 00AEC208 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

E, xrefs: 00AEC294

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 9ab90b0815ff1f479049632eaff4380d56f54f145510b52551596628210a5f05
Instruction ID: ec165ca9d2054cc25a353762b4dace578688910e54f2de966775510f1bba3dac
Opcode Fuzzy Hash: 9ab90b0815ff1f479049632eaff4380d56f54f145510b52551596628210a5f05
Instruction Fuzzy Hash: C36175355083628BD30DEF28D4909EAB3E2EBD2320F50CA7ED196CB5C5DB39551ACB80

Function 009B145C Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

g, xrefs: 00ADF67B

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: fef18053fac39e96818fa3c544b0666b7d555774dfbc9e11ee2677a5dfe181ae
Instruction ID: 2d03477042a116d6f4808fcd4a26ba187a9246343b5d155a27471884c52ae7ec
Opcode Fuzzy Hash: fef18053fac39e96818fa3c544b0666b7d555774dfbc9e11ee2677a5dfe181ae
Instruction Fuzzy Hash: 9151773251C70A8AD31CEF28E8425BBB3E1EBD1321F20967ED58AC3592EB759412C756

Function 0083A083 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

>ebg, xrefs: 0083AA95

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: >ebg
API String ID: 0-4222723227
Opcode ID: d72507aebaadd30abb4275683c8ddeb160b985be0c8d34d9105457ac27c993ba
Instruction ID: 30afbb52fafe69ea5ac864733335d89e69c77b5e670445da7523ec2085683f55
Opcode Fuzzy Hash: d72507aebaadd30abb4275683c8ddeb160b985be0c8d34d9105457ac27c993ba
Instruction Fuzzy Hash: 035148225483558FD7288B288480767BBD1FFD6350F0A8678D9E18B3D2D2358909D3D3

Function 00A0C70C Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

;?, xrefs: 009D977E

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ;?
API String ID: 0-514393361
Opcode ID: 9460c212049383bb352e480f74d0c9ba4b06b3fd9d19f797a45dc7791988b95c
Instruction ID: 7d89402fa3efae10f61177d606c19eeec0e1dfede448ae78aaaf3ce5e17599d4
Opcode Fuzzy Hash: 9460c212049383bb352e480f74d0c9ba4b06b3fd9d19f797a45dc7791988b95c
Instruction Fuzzy Hash: AC5175345087028BD708EF38D8515EBB3E2EFC9324F508B3DE49687A90E774981ACB95

Function 009336F8 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

C, xrefs: 00AAC813

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 98f02d864c7efaf1488b75c8119da351f21e2a52d7f568168819ffa3947fa9a5
Instruction ID: 57f64c686784b4bc27381a03a7b14016136f8f502ab6b60830d0f5d41a6433ca
Opcode Fuzzy Hash: 98f02d864c7efaf1488b75c8119da351f21e2a52d7f568168819ffa3947fa9a5
Instruction Fuzzy Hash: D051AD362192168BC718EF6DE8110EF73E2FBD8300F25C93ED186CB695DB35481A8B81

Function 00A0E22F Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

g, xrefs: 00ADF67B

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: 6c96f48346ca5810577366c2d3f63e8efc61b0efe07a55974589cc73bdcaae86
Instruction ID: 0e6e5a7a3b6be37a7ad8acf1f800f346593e5ff7259c4d8db609b487897f5e8b
Opcode Fuzzy Hash: 6c96f48346ca5810577366c2d3f63e8efc61b0efe07a55974589cc73bdcaae86
Instruction Fuzzy Hash: 0641873261860A8BC31CDF2CE9C65BAB3E9FBC4311F64863ED58BC3591EB74511A8685

Function 009DC325 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

", xrefs: 009DC400

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 0a337889224c764d010fb063989f173144943323fb692702b6671d99356d0558
Instruction ID: 08f6e535a07b34970e3b4154dbc8976f23be1b55829da3e862ba7513b55253bb
Opcode Fuzzy Hash: 0a337889224c764d010fb063989f173144943323fb692702b6671d99356d0558
Instruction Fuzzy Hash: 4F516A3654C7428FC319EF3C98694A9BBE2EFD6310B2486BED092C75D1DB715016EB02

Function 008F11BF Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

*, xrefs: 008F1213

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: b164198cbb187576efaaa8913cd3556f47c5c2088072b8202fb49aaf8773f3d3
Instruction ID: d39203b59237d9ffe7ab394d30f51654bd9eed58e4bfa9e6ef314acae391400b
Opcode Fuzzy Hash: b164198cbb187576efaaa8913cd3556f47c5c2088072b8202fb49aaf8773f3d3
Instruction Fuzzy Hash: 9C5148765187128FC308EF29D9802BEB3E1BFD5310F118A2DE5D987285D739980ACB82

Function 0086EBD5 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

z, xrefs: 008FBD9E

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 884a6380ad4f0287cacc604c6d4c89f882129bf3490aab09409d3323766334d0
Instruction ID: 029b5fbf9bdd908bd0afc7e945efde7bedd6dae93c46c9a8a5e6a7716e6bb045
Opcode Fuzzy Hash: 884a6380ad4f0287cacc604c6d4c89f882129bf3490aab09409d3323766334d0
Instruction Fuzzy Hash: 0F5178315187028BE71CEB38D8519EBB3D2EBD5360F608A7ED059CBAC1D779940ACB45

Function 00899616 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

4;, xrefs: 008996EE

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4;
API String ID: 0-1274546220
Opcode ID: f542855982292a85faebd6f7dcda25a507f57326286a01b107c702669de3163a
Instruction ID: d86a2257713c2972e12f7742416c3b4175ca7ffadd782923349e21785ca383ae
Opcode Fuzzy Hash: f542855982292a85faebd6f7dcda25a507f57326286a01b107c702669de3163a
Instruction Fuzzy Hash: 665185362282924BC709EF7C94944ABB3E2FBC5310F60CA3CC496CB8D4E735911ACB41

Function 008FD3D2 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

j, xrefs: 008A3013

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: j
API String ID: 0-2137352139
Opcode ID: 08d0d73861b26efb465f497b60fc13b231c019f0526407f8bd117eafe128491c
Instruction ID: d2e56e85b5b1a39b78131a2969ffd37bdd4d4784f399a312ab8be8dfdfd5c4ea
Opcode Fuzzy Hash: 08d0d73861b26efb465f497b60fc13b231c019f0526407f8bd117eafe128491c
Instruction Fuzzy Hash: 3A416A726187128BD318EF28E4846AB7BE3FBC5310F248A3EE586C3195D73A5419CB41

Function 009155D9 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

N, xrefs: 00988BBA

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: c4d61b3b4a23a47cb729e1908c8f49c9e79d42e7714c7ff4c4015304c8ce51c9
Instruction ID: a74de743a57f6c79763183ffc8c00551b7f889515c32cc4e702e3df438303693
Opcode Fuzzy Hash: c4d61b3b4a23a47cb729e1908c8f49c9e79d42e7714c7ff4c4015304c8ce51c9
Instruction Fuzzy Hash: 5441673120C35A8FD718EB29E4800ABB7E6EFD6324F28C93ED492D7185E6791509CB46

Function 009082BE Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

m, xrefs: 0090831A

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 057eddc4bb4f9164777988625b1d8620ff4c2eb52f2415d47cd4b4c8849cc5a4
Instruction ID: 9e664158fef6011e2a3e7beb13b59e4c48801aae7212c4f74b20c6e81e06040f
Opcode Fuzzy Hash: 057eddc4bb4f9164777988625b1d8620ff4c2eb52f2415d47cd4b4c8849cc5a4
Instruction Fuzzy Hash: 9C4179352187128BE71CDB38D4545EA73E2EBD5320F548B7ED0598B5C6C7B5640ACB08

Function 00A6C8FE Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

5, xrefs: 00A2E2A8

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: a317963dcd32a65f4676c69d47b18ca8571ae166098309b8586d389d6ababbee
Instruction ID: da9e4765e282d2c83217928c3d806458e08857b6f8cde96bb36c4c589353c352
Opcode Fuzzy Hash: a317963dcd32a65f4676c69d47b18ca8571ae166098309b8586d389d6ababbee
Instruction Fuzzy Hash: EE4154320186064BC31CEF7CA8558F6B391EF99311F64D63DE5DAC38D4DB2584469B08

Function 008A2860 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

V, xrefs: 00A97AE6

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: 5e03c7920016520fd965c33f67cd0c5eda8b938cc52451a5d105112c1a6bdbc4
Instruction ID: 7cf10cbba98078c5cdc54e04b8df610993420275193b758fb5c663ddb30be0d1
Opcode Fuzzy Hash: 5e03c7920016520fd965c33f67cd0c5eda8b938cc52451a5d105112c1a6bdbc4
Instruction Fuzzy Hash: 9041253610C3428BD708EF69E8514BAB7E2FFE1320F68CE3DD49A86491E735451ACB12

Function 00AD4343 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

g, xrefs: 00911981

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: 9ed91c37d5f21b3714a3e4fed488a3e36f050ecb73eae87d8b9b3a3d88f4f349
Instruction ID: 78b64e2ce05242597b3061903b56b7c0e89b94b87ab5a6947ba47e1a99439aff
Opcode Fuzzy Hash: 9ed91c37d5f21b3714a3e4fed488a3e36f050ecb73eae87d8b9b3a3d88f4f349
Instruction Fuzzy Hash: 5731C8720682598FE70CEB6CD8428FB77A1EBC6321F64C23EC48387483D229511BCB06

Function 00854C40 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

@, xrefs: 00854CA9

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 287eeaafd4a5a2df0e6ef6aafe00474908f358fcdf4d4550f62375f54d28b624
Instruction ID: 6df931d1d92e4d5e2d66c626cac1cf50a1d93a80ce19fa82ac0c557a8099e04d
Opcode Fuzzy Hash: 287eeaafd4a5a2df0e6ef6aafe00474908f358fcdf4d4550f62375f54d28b624
Instruction Fuzzy Hash: EE3133715083049BD328DF68D8D16AFB7F5FBD5318F04A92CEA8587381D3789888CB96

Function 008535F0 Relevance: .9, Instructions: 880COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ab91d96b614ffc32b5fa80087b3f1f2b0063c5578c7861bfb2dfe3bef1e3c0
Instruction ID: 35af365af66f293469477614e6fc15e49ef7f4457e5a74470232ebf74f6bfedf
Opcode Fuzzy Hash: a8ab91d96b614ffc32b5fa80087b3f1f2b0063c5578c7861bfb2dfe3bef1e3c0
Instruction Fuzzy Hash: 8F421431A18311CFCB08CF68E8A166AB7F1FB89316F0984BDD986A7351D7349E45CB81

Function 00853740 Relevance: .8, Instructions: 750COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c3befec7e328fd0a647f51c71b9aa57b1f597ad59815ac71e6485802cd9ee9
Instruction ID: 1c1cd75a5f9584216d616218f0bef6cc101708001c062f85e55a672c52010c12
Opcode Fuzzy Hash: f2c3befec7e328fd0a647f51c71b9aa57b1f597ad59815ac71e6485802cd9ee9
Instruction Fuzzy Hash: E1320331A08351CFCB08CF68E8A166AB7F1FB89316F0944BDD986A7351DB349E45CB81

Function 00833770 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6651b1095558d970ef62b5f41a450cd9c6a3b20614b4b8dc8311f196beaeea5f
Instruction ID: b5d934dcf70c424c4f31e3c266a7da0876692d97586233502d3edaca9fdf2785
Opcode Fuzzy Hash: 6651b1095558d970ef62b5f41a450cd9c6a3b20614b4b8dc8311f196beaeea5f
Instruction Fuzzy Hash: 6F729EB0608F808ED3268B3C8845797BFD5AB5A324F184A6DD0EEC73D2C7756509CB66

Function 00842240 Relevance: .7, Instructions: 691COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb1bcb70acbfee4e27b4b6e957280d31536ee8554e67a9fbc0ed815040a97e41
Instruction ID: 094fb0d512ae5ad1a6e2d239fefd8fb7469eb57886c23a631f17329243a4ad1c
Opcode Fuzzy Hash: cb1bcb70acbfee4e27b4b6e957280d31536ee8554e67a9fbc0ed815040a97e41
Instruction Fuzzy Hash: F96270F0611B009FC3A1CF6D8892B82BBECBB0D751F00495DA5AED7351D77569088F66

Function 008170B0 Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c0a514269d6fcaccdb18de83aa07a17cb71578b91ccb2d626c46233c4fd06d
Instruction ID: 135221a27d7374f5cac1468a0c0d677eee375894113eed322a4e6ca92339ea0e
Opcode Fuzzy Hash: b1c0a514269d6fcaccdb18de83aa07a17cb71578b91ccb2d626c46233c4fd06d
Instruction Fuzzy Hash: 1F52BF3150C3498BCB15CF28C0806EABBF5FF99318F198A6DE89A97351D774D989CB81

Function 00853A90 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cf69de1d4e456d8f84cffc09728290288dafaa5b11e95af6da423d564b0ed0
Instruction ID: a193e84422603a5b3a2226c36dcfe60fb3c1be9012b07643e2fa66a2a8e9935b
Opcode Fuzzy Hash: 41cf69de1d4e456d8f84cffc09728290288dafaa5b11e95af6da423d564b0ed0
Instruction Fuzzy Hash: 65120531A08351CFCB08CF28D8A166EBBF1FF89315F1985ADD99697391DB349A05CB81

Function 008539C0 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e03848695edb9c7576e03f9d8d44702e5f7b93e84abcbc0155061828c85ecd7
Instruction ID: b20e35b45b681bd31f3eba301a5cdeee05fcbbd6af81567a03caf325bcb5b85d
Opcode Fuzzy Hash: 1e03848695edb9c7576e03f9d8d44702e5f7b93e84abcbc0155061828c85ecd7
Instruction Fuzzy Hash: 7812E431A08351CFCB18CF68E89066AB7F1FF89319F1984BDE58A97351DB349A45CB81

Function 00817AB0 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a76f43f9fe990f747d7c375593ff1ab373edc1d35ce6756844ae8345fd710c3
Instruction ID: 5aabb1961bc54541fd1fe75f41ef292da9b9a89070539e3d5482547a7c216d66
Opcode Fuzzy Hash: 9a76f43f9fe990f747d7c375593ff1ab373edc1d35ce6756844ae8345fd710c3
Instruction Fuzzy Hash: 8E421171518B148FC368CF29C5905AABBF6FF85710B604A2ED6A787F90D736B885CB10

Function 0083C3A6 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bccf84cf9b8f6cf3ad4bae2c43e684d02fb0d27eda57d0ab6e68ce93c696566c
Instruction ID: 503d0f1b1bfb4facd8ad9271f5c7ce06ca2bbf3899ef01472b365272f3ee66c2
Opcode Fuzzy Hash: bccf84cf9b8f6cf3ad4bae2c43e684d02fb0d27eda57d0ab6e68ce93c696566c
Instruction Fuzzy Hash: 62F1BC71A04355CFDB08CF68D8916AEBBB2FF8A311F2985A8D451AB391D335AD41CF90

Function 0083AB20 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aad8535dfd53d9d0d7fb6daefe3d9810c80ddadcd2cb6d4a4dd11235814260fe
Instruction ID: 4588653cf3d50078645317e2f0223fd28b038f5c106493757bcf4fcc738b183e
Opcode Fuzzy Hash: aad8535dfd53d9d0d7fb6daefe3d9810c80ddadcd2cb6d4a4dd11235814260fe
Instruction Fuzzy Hash: 3BD16B726483044BDB189E2888816AB77E2FFD5314F19852CE9D5CB392E3789D0A97C3

Function 008191E9 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903c1a8375b043cd479242b10a1a3b7caa97cabac533b27af5b929761f748981
Instruction ID: 84fa6b6bc4757517d10fd705304f35c7f986fd3e4743ba83f9d5e552617aa3bc
Opcode Fuzzy Hash: 903c1a8375b043cd479242b10a1a3b7caa97cabac533b27af5b929761f748981
Instruction Fuzzy Hash: 88123275608340DFD714CF28D890B9ABBE1BF8830AF18896CE58987391D739D995CF92

Function 00853D90 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539d7a8ea2468a6daef91cf5bf7f4511696451d1220c81ba93867f01c880ff64
Instruction ID: 2f031f18d9aeccea93b4ceb33f103b5d89faecfd21b8dd37c7626573a40563b8
Opcode Fuzzy Hash: 539d7a8ea2468a6daef91cf5bf7f4511696451d1220c81ba93867f01c880ff64
Instruction Fuzzy Hash: 63C1E332A05215CFCB18CF68DC902AEBBF2FB89315F1984BDD985E7341DB349A058B91

Function 0082D7F8 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe845af7c74b6b87cdf8b95eec76e765ab9a5a9fcd3a18c546276246ae496d2
Instruction ID: 21d5f60da4773f7e090b9ed8b86c050571902ee3b4217cfbee88dcc0bccf0cc1
Opcode Fuzzy Hash: afe845af7c74b6b87cdf8b95eec76e765ab9a5a9fcd3a18c546276246ae496d2
Instruction Fuzzy Hash: 75D112B55047418FD724CF28D881763BBE2FF59314F188968E89ACB792E734E886CB51

Function 0081A260 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f564ef8ddd68ba63a4aae7c67abed358b324630ef6690362dffd20124c30bc5f
Instruction ID: 34501b781315b9da6a5e5ee125df52633a8dce63ab88744c9e629b3705b0ac7d
Opcode Fuzzy Hash: f564ef8ddd68ba63a4aae7c67abed358b324630ef6690362dffd20124c30bc5f
Instruction Fuzzy Hash: 61E18A711093458FC725CF69C880AABBBE5FFA8300F44882DE4D987751E375E988CB92

Function 0084F800 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9136dc5f38f7e19e1fdb048f7b83bc4e2fdc2735546cc33c462cda442fbe067
Instruction ID: 901c12962f2a8b27692eb28201679048e52df8f924ad2e638e3978e5e001df19
Opcode Fuzzy Hash: f9136dc5f38f7e19e1fdb048f7b83bc4e2fdc2735546cc33c462cda442fbe067
Instruction Fuzzy Hash: C6D1D171A0C3A54FC725CF28C49062AFBE1FF95214F0986BEE9E58B353D6319845CB92

Function 0084B0F0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8399e848cd875c38517825f1549d04d06f74960938bb009e02c806da9e56d7
Instruction ID: ff68c47934d024e5cf3bd8536ab5e6e88dac581ab2091136dc1c753f31270d76
Opcode Fuzzy Hash: 5b8399e848cd875c38517825f1549d04d06f74960938bb009e02c806da9e56d7
Instruction Fuzzy Hash: 54D12B72D046998FDB11CABCC88039DBFA2AB57324F1D8295D5A4EB3C6C6768C06C761

Function 0083B3D0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32ac99dd114a8f41121854ee3f11b01bd397d71990e990a5b8996cf8cef09a8
Instruction ID: 59e6e227a534eb530c5764c3c43d6fd91f22d13ee7414ff00bdd1f7d20718224
Opcode Fuzzy Hash: e32ac99dd114a8f41121854ee3f11b01bd397d71990e990a5b8996cf8cef09a8
Instruction Fuzzy Hash: 98C1C1B15083828FC714CF28D49126BB7E2FBD9314F18896EE5D987252E339D949CB93

Function 0083A112 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6165e55e5544c7129c6459a268e9a9e1fef4d63bb73f8d9c8895b5305c57820e
Instruction ID: 5637af2e9d4dc50fb5e220c8b6bf46c6d93ceba3edc706367633c5be26e25e95
Opcode Fuzzy Hash: 6165e55e5544c7129c6459a268e9a9e1fef4d63bb73f8d9c8895b5305c57820e
Instruction Fuzzy Hash: E891DD75208341DFD7189F28DC815AAB7E5FBDA309F08582CE5C5C32A2D739D916CB82

Function 0083E3F0 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92871d84437d453c3a75988e3ddb5b4f58f7ec94500d5ed16dccea4189ac58f
Instruction ID: af34bcb1b45db3980d4124b949b015792d5e1cd29eaaa64a33c8720c5e8e1bf2
Opcode Fuzzy Hash: e92871d84437d453c3a75988e3ddb5b4f58f7ec94500d5ed16dccea4189ac58f
Instruction Fuzzy Hash: 9C81F5B2A083545BE7258E29C88176BBBE5FBD1308F09897CE895CB2C1E774DC0987D1

Function 0081ADB0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fba7223acfd10db0f391d351cfcbf7d6592e11471e579e9e97b846370c549f3
Instruction ID: 8fdb77389dc48b26ec61b8d2e0864e6c45e1a932c0765f1bd5dd8fbb4ed91a9b
Opcode Fuzzy Hash: 2fba7223acfd10db0f391d351cfcbf7d6592e11471e579e9e97b846370c549f3
Instruction Fuzzy Hash: 34C16DB29487418FC320CF68DC96BABB7E5FF85318F08492DD1D9C6242E778A195CB46

Function 00855330 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 940d3fc65e929eaf0b3a4cc35336f5e1c7dd21536a2ccbe3ad79d87c8dabd712
Instruction ID: 671b51c4f161d9004c7e68cf0f65d25b8490123b2acde6fc095b51367ab52854
Opcode Fuzzy Hash: 940d3fc65e929eaf0b3a4cc35336f5e1c7dd21536a2ccbe3ad79d87c8dabd712
Instruction Fuzzy Hash: F1A1DE756087119BC724CF28C8A066EB7F2FB89752F14892CEE858B355E771EC45CB82

Function 0084B7B0 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033cde5b7a8226fa5324fc38e0f1f0eba00e2fee7c83d5439c00a92c3e818f71
Instruction ID: 282f7820b967325e4ef2940c7867a057c491333661a1b6a789f21bba3359c0dc
Opcode Fuzzy Hash: 033cde5b7a8226fa5324fc38e0f1f0eba00e2fee7c83d5439c00a92c3e818f71
Instruction Fuzzy Hash: 08B1137260C3888AD3149A38895436BBFD2FBD9328F198A2EE5D6C33D6D774C9048717

Function 00824A4C Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b1e0c695c516f1251042fde56747ceffd01dcaf599c286d85d600983a2cf76
Instruction ID: 0d940af635fa912f7aaa2e12d46b9c695b6cd17cae9361609c529b02134a4ff0
Opcode Fuzzy Hash: f9b1e0c695c516f1251042fde56747ceffd01dcaf599c286d85d600983a2cf76
Instruction Fuzzy Hash: 4CC10471515F808FD3258B38D8583A7BBE5AB56314F188E7DC8EBC73C2D635A1448712

Function 00855040 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7a5364c85f2f1091d181de90a4f09de393edfa8f5e43875a454d6921fd2bff2d
Instruction ID: 7831eec24e539e1c54522fe0078a6b60305690107b0838c4a55a7129558e700f
Opcode Fuzzy Hash: 7a5364c85f2f1091d181de90a4f09de393edfa8f5e43875a454d6921fd2bff2d
Instruction Fuzzy Hash: 5981E335604B129BD718DF28C8A0A2AB7E2FF98711F15852CED85CB361E770EC55CB82

Function 0084C132 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdd4390f4b311d9b20b7ec12a1658262c329f91e116fbbf5e9944914f5fbfc1
Instruction ID: a8bf84c375a2443f0ccac22a878de8a2f964e3f3711b4e3aef225e72be657d72
Opcode Fuzzy Hash: 6cdd4390f4b311d9b20b7ec12a1658262c329f91e116fbbf5e9944914f5fbfc1
Instruction Fuzzy Hash: 79811736608314DFD320CF28E88077AB3F9FB99316F16486CE989C7291D7B59805CB92

Function 00823E45 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d197599495319bb6b2da28c72c4654d62be378fc1e461a34429f230d187cb97
Instruction ID: 3390328e25001e25148d6d8edbdc165e773eca165d82dcee6b7e483a1c42fb05
Opcode Fuzzy Hash: 9d197599495319bb6b2da28c72c4654d62be378fc1e461a34429f230d187cb97
Instruction Fuzzy Hash: 3BB1F0B5608B808FD3259B38D4553AABFE0BB56314F484E6DD4EBC7382E235A049CB12

Function 00843E24 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8faee804e823a104e24101c70fdb1ab6c5a7c9383b4e6ba0c93962bc8aa6c7
Instruction ID: 9079228925217f6b7508faf1bb260ba272050a4a908d8b45e9bf47f7e62c3923
Opcode Fuzzy Hash: fb8faee804e823a104e24101c70fdb1ab6c5a7c9383b4e6ba0c93962bc8aa6c7
Instruction Fuzzy Hash: 62B10672A09B808BC3558A38C8983EABFD2AFD5314F1D897CC4DEC7346DA396449C712

Function 00A05000 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55ab33ba647fb48d3de2cb58244ec1f648221b48b6d78eb1cd34756bf4c2640
Instruction ID: aa102033d390f4c311f12a236f5efb6708d14d2a200ad9d8fe0ffdeea259777d
Opcode Fuzzy Hash: b55ab33ba647fb48d3de2cb58244ec1f648221b48b6d78eb1cd34756bf4c2640
Instruction Fuzzy Hash: C29156325086468BD318EF28D8505BAB3E1FFC9314F64CA3DD196CB6C9E73499068B41

Function 00844BC7 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2199d5db8f011725805a65f7e69af872dd2df59057d4f4cabfeae211ddd84e5b
Instruction ID: e9b79fc14d16ccfddb76ddc788daf10a3f09165e3c27fb3e32cc6b8c05f928d1
Opcode Fuzzy Hash: 2199d5db8f011725805a65f7e69af872dd2df59057d4f4cabfeae211ddd84e5b
Instruction Fuzzy Hash: 4EA10371A09B808FD3158B38D4953ABBFE2EF96308F0C897CC4DE8B346D67960498712

Function 00844461 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75587898d4b20287e5d10b609ca1fbdbe6397157e5c19bc964121fa90aad5611
Instruction ID: 925378473d8793f5a4c8c06f87f4c0eab49811cb300e06d5b4fc1d0d3a065532
Opcode Fuzzy Hash: 75587898d4b20287e5d10b609ca1fbdbe6397157e5c19bc964121fa90aad5611
Instruction Fuzzy Hash: CEA1C671A09B808FD3159B38D4953ABBFD2AF96308F0D887DC5DE8B347D67964098B12

Function 0089BA9E Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b6712467a8226cd06661b3003399bfcdd7e525640eadc4fe6be05b9998f49d
Instruction ID: a5336200f8b8ee95e3debc9e8db22c976484017373a2ca280e7ad4d07c5cc518
Opcode Fuzzy Hash: 51b6712467a8226cd06661b3003399bfcdd7e525640eadc4fe6be05b9998f49d
Instruction Fuzzy Hash: CA51B932818E094B971CEF59EC865F6B3C9F785311B10973EC8C7C7086EA3665178AC6

Function 00852165 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cddc9d93f46fc96c5a085207a3ad491c4ade6b2b31ddc9f05699258e0bb04d0
Instruction ID: b0e3b5e35657fac8211fbc3ab6147010c87768e4520d1edba602258c8a5e801c
Opcode Fuzzy Hash: 5cddc9d93f46fc96c5a085207a3ad491c4ade6b2b31ddc9f05699258e0bb04d0
Instruction Fuzzy Hash: 38812536A14225CFCB08CF78D89156EB7B2FB8D326F19826DC512A7391D734AA41CF81

Function 00FCC561 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52402073d743ceefe9f7106761877521b943fd889f171be2b186cfee03376cf
Instruction ID: e4ff88f92be29f0c52f14a84f27fdc53982fcf587a3678a8451461bda19d7469
Opcode Fuzzy Hash: d52402073d743ceefe9f7106761877521b943fd889f171be2b186cfee03376cf
Instruction Fuzzy Hash: BC719736508B168BC72DDA68E4812AAB3D2EBD2310F544B2ED9D2831D6DB355627CAC1

Function 00818EF0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bac44199131048f3b12b41b27915c3c447e9605807d7869fa4412110c5d71a
Instruction ID: d70c9ab9923d99fedfdfb1646621f5c1578e329d71a20ea53c668526d538f27b
Opcode Fuzzy Hash: 85bac44199131048f3b12b41b27915c3c447e9605807d7869fa4412110c5d71a
Instruction Fuzzy Hash: 69717975608302CFD708CF14D8A07AA7BE2FB89346F1595ACE88947391C779D985CF81

Function 008540E0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4149c6a879662732f38c80b86fd1c9fef2020f90ee8c77661a70ac36f690d2
Instruction ID: e40a37fcb0c48d5b79452097bcf555968f6721f97629f293a81778098952c673
Opcode Fuzzy Hash: 4f4149c6a879662732f38c80b86fd1c9fef2020f90ee8c77661a70ac36f690d2
Instruction Fuzzy Hash: E851B032608351CFD318CF38DD8065AB7E1FB8A316F5989ACE899C7250DB389945CB52

Function 009CE50F Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a486db666818c2e1bd888186be0954b1c96f489685e49a8edc7ce2c5e0768d9e
Instruction ID: db0f175bc1a9a232a8e2dfd3d70483cbe8d908a11514139bee6a1268aeae29b5
Opcode Fuzzy Hash: a486db666818c2e1bd888186be0954b1c96f489685e49a8edc7ce2c5e0768d9e
Instruction Fuzzy Hash: F57187352046268BD718EF3CD8909E673E2EBD1310F51873DD056CB5D5EB3AAA1ACB80

Function 009A3920 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14fea935e3523c97b77cadddb4e0be65ceefd4ec75d2a0a23106333845e8dbbe
Instruction ID: 09147110aef1665030e7b1885c5c69d41ec0d3feb4d9192b25471dad6a92d20f
Opcode Fuzzy Hash: 14fea935e3523c97b77cadddb4e0be65ceefd4ec75d2a0a23106333845e8dbbe
Instruction Fuzzy Hash: E18122315187128BC714EF38E8815ABB7E2FFD2320F51CA7EA495C71A9D335811ACB86

Function 0084AE90 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ee3151b8b6ba79c11c71b66349c50084ad847877ff76d03cbff6a12dc2a541
Instruction ID: 8aa3dff4c9ee77409a2caa6a8bf73a228a41416ad1ade69bc67e8fb0c4a89fde
Opcode Fuzzy Hash: 82ee3151b8b6ba79c11c71b66349c50084ad847877ff76d03cbff6a12dc2a541
Instruction Fuzzy Hash: 2D515CB15087589FE314DF29D49435BBBE1FBC4318F044A2DE5E587350E379DA088B82

Function 00980BB1 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9593c72638cf4f5151b6ea00b93eed72279f3c8c9d04c7d5e026bd3f524743
Instruction ID: a95807a5a33cf78afacb7db7f5e6f1da3b62634c7f3382de7ad9161b2ec31c8c
Opcode Fuzzy Hash: ca9593c72638cf4f5151b6ea00b93eed72279f3c8c9d04c7d5e026bd3f524743
Instruction Fuzzy Hash: 415189356042668BD30CEF78CC515EA73E2EBD6310F54C67DD196CB1C5EA399A1AC780

Function 00815890 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04c3594dcd91fd81363db6d255754bb69e31387a73b8d08c2d443e481468dda
Instruction ID: 26eb854c906231974a4aefa0ba41109d49319297576b9f7a076cb6d44ef48329
Opcode Fuzzy Hash: b04c3594dcd91fd81363db6d255754bb69e31387a73b8d08c2d443e481468dda
Instruction Fuzzy Hash: 5E517F75A04610DFC714DF18D880966BBE9FFC9364F158668E899CB392D631EC82CB92

Function 00A32671 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06005a92eb47bbcc6777b253358a13d2399f622a277bd004ea009716f3fba752
Instruction ID: fc6b6b75ef84dbb722a4894d150bd87471af674a1134756bdf8117662ebfe737
Opcode Fuzzy Hash: 06005a92eb47bbcc6777b253358a13d2399f622a277bd004ea009716f3fba752
Instruction Fuzzy Hash: 0151CC362086478BC704EB78D8914FAB3D5EFE9310F54CA7DE08ACB691EB35A505C752

Function 0096E157 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f38392664ef3302b93c8c938217aeb696644103a09b566ff0e4fad84418275
Instruction ID: 5fda0199c01e5fafe2e17ff59e472a5e4a7b329ee20a3b7a7ecb5bc434eba7f6
Opcode Fuzzy Hash: 21f38392664ef3302b93c8c938217aeb696644103a09b566ff0e4fad84418275
Instruction Fuzzy Hash: 2B51BA32918216CBE718EF28C8926E673E2FBC2324F54873ED4558B6C5E73A511BC781

Function 008265D7 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b3e6893c07d86f9b7e1507a6a17e830a63abc698d3d456bbcd5cbc2b64d75d
Instruction ID: 3e5c496f349ea63b548caeed8608996e554c986c108b43affd503dce5437ddd3
Opcode Fuzzy Hash: f2b3e6893c07d86f9b7e1507a6a17e830a63abc698d3d456bbcd5cbc2b64d75d
Instruction Fuzzy Hash: 45610972518F818FC3258A38D99436ABFD0AB56228F494F6CD4EBC77D2D268E145CB12

Function 00826997 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e914b42256f071b9fc55cffcf399b303a8695dbc396b852efd4027b0c97edc2c
Instruction ID: cd0898d12ec282f006b4a6cca08147beb3d837b2a5faf05f954faaafdf161744
Opcode Fuzzy Hash: e914b42256f071b9fc55cffcf399b303a8695dbc396b852efd4027b0c97edc2c
Instruction Fuzzy Hash: 37513672118FD14BC3358A3888952AABFD1AB57224F898F6CC4EBC77D3D628E445C712

Function 00814BA0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e238b539ad586fce2b2a5f818bb7ed3a7dde90334dc713d76b4f5c0888172b
Instruction ID: 731bb820a8df8d427b6cfe663f6533a7c771e2b0a0afdd3ea9763dbe86242481
Opcode Fuzzy Hash: f0e238b539ad586fce2b2a5f818bb7ed3a7dde90334dc713d76b4f5c0888172b
Instruction Fuzzy Hash: EA415F639105250BEF580A34ECB43F97749FF81364F1D13BDE9A6CB3D2D66889C89291

Function 00AE42FF Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6819ad0efc2bc19ca3364e056e2bb1c612e09dc17b920d125bb77ff689033e6
Instruction ID: b0d48ff82edcded5da82fec490c1833e2bbd73758bf1af5517d611b5120581ab
Opcode Fuzzy Hash: f6819ad0efc2bc19ca3364e056e2bb1c612e09dc17b920d125bb77ff689033e6
Instruction Fuzzy Hash: B5518935614B134BE71CEB38D8909EAB3D2EBC6321F91877DD059CB1D5DB79940ACA40

Function 008695E3 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064b80ae447cbe6b5d780914f2b8c9654ffd42648d513a4d5fc3242d8caaeb35
Instruction ID: ccfc60b6bcf5396d82954e9e6de584019a1761598e9627b5e4361ed494bdd8bd
Opcode Fuzzy Hash: 064b80ae447cbe6b5d780914f2b8c9654ffd42648d513a4d5fc3242d8caaeb35
Instruction Fuzzy Hash: D65155355083128FE708EF29D4919EA73E2EBD5320F51C73DC1968B1D5EB35951ACB40

Function 00D10ADA Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4f5ff5335e5e5e0e69cc374a6aebfbafa1b45419f076d0f0eafe915d93ca94
Instruction ID: 80840cbd1cda79f11064762485acfbce60fc9cb30f4afc733f922baae0e38c07
Opcode Fuzzy Hash: af4f5ff5335e5e5e0e69cc374a6aebfbafa1b45419f076d0f0eafe915d93ca94
Instruction Fuzzy Hash: 5651997180869A8BC71CDB6DE8901F673E2FBA2310F10476ED5ABC75D5DB30152ACA85

Function 0083A510 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b96de5cd57ae3fc92bf70ea0f27ea4653f1350ee403c5227c5cf2aee700a4b
Instruction ID: e7c67ddcf651ab4ad762795a8f1da060600657c2f292fdc6317b5a964d858194
Opcode Fuzzy Hash: 82b96de5cd57ae3fc92bf70ea0f27ea4653f1350ee403c5227c5cf2aee700a4b
Instruction Fuzzy Hash: 66412572608301CFE7188F24DC9276AB3E5FB99305F19883DE5C2D32A0D678E955CB42

Function 009E5349 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3aeb55a36bff070542a0ecd19ff68be15a74a957062f038dd34092962170c03
Instruction ID: 10889b36c58eaeaa62ce8317a417067db67802f994823f97c0ee3c3e87e53122
Opcode Fuzzy Hash: d3aeb55a36bff070542a0ecd19ff68be15a74a957062f038dd34092962170c03
Instruction Fuzzy Hash: C2418576A287554FE31CEE7998921AA33D2EBE9310F20C63DC5D6C31C5DA3A540A8742

Function 008C87DA Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a05426a2e5be4ba5c678bf5ae337fbea33cf041e4f8bce2681cda9fa2993d9
Instruction ID: 6f691af8b1653b8d50bd3783c88bc6d481767182b157816a625eefd155a18667
Opcode Fuzzy Hash: d0a05426a2e5be4ba5c678bf5ae337fbea33cf041e4f8bce2681cda9fa2993d9
Instruction Fuzzy Hash: 3A4175356042528BD70DEF29C8918EA73E6EBD5314F51C23DC156CB8D6EF35AA1AC740

Function 0083F570 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e687a0c77350db8feca64d9f86feccd65f2483804513ff3c6c37ab7cf7ce89
Instruction ID: bfff625f984386614cd2e740061a1bcba58117c8f4607fc0ca5cae7fa596d5ba
Opcode Fuzzy Hash: f3e687a0c77350db8feca64d9f86feccd65f2483804513ff3c6c37ab7cf7ce89
Instruction Fuzzy Hash: D53137B3E14A280BD7188D2D9C1623A71829BD4215F4E873EDD6ACF3C2EE304D1592C0

Function 00A702FC Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151a2b577b3beabbceee2bacb18a3c10b9512b9aff70514b218f76e57d68ddab
Instruction ID: 698053707588c3b367fd7eb4d416ff6291acb9a67645286e5ca6144c78a794dd
Opcode Fuzzy Hash: 151a2b577b3beabbceee2bacb18a3c10b9512b9aff70514b218f76e57d68ddab
Instruction Fuzzy Hash: A14179356042628BD30CEE39C8914EA73E3E7D1320F55C23DC156CB5C5EE3A991AD740

Function 00A735BC Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5433e56af7d26e7cef932317d9823b417fa466bc6307cafd23575c6d8aeeba65
Instruction ID: 9ee30baffbd9f039cb8d79b03af4bc1f074d03a807d93145aca6e3894a09c6c6
Opcode Fuzzy Hash: 5433e56af7d26e7cef932317d9823b417fa466bc6307cafd23575c6d8aeeba65
Instruction Fuzzy Hash: BF41CC367049125BC31CAE3CD8121FA7392FBC4310F64873EA967C3AE4D739981A8685

Function 008C5352 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb62165a46611bbc4fa4c448c4f97565b81d46738c68b4b2fc5f73fabf16abe2
Instruction ID: 5c30e621bbfe8c94d4363cb0a2bbf190c50d9877eccec4d2295ce239ea2a524b
Opcode Fuzzy Hash: bb62165a46611bbc4fa4c448c4f97565b81d46738c68b4b2fc5f73fabf16abe2
Instruction Fuzzy Hash: 1241EF2A115A538BC70AEF39CC551FA7783AFE6320B08836DC091871DAEB795046C341

Function 008F4611 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd8f4a54593e4d26398b396c8991c4533a7cd7d77c63367af1df2e86823dbb7
Instruction ID: b4502838b010bb5d939b8e7bb0df80975ed95a4008c1d53c463bff68dea11860
Opcode Fuzzy Hash: 1dd8f4a54593e4d26398b396c8991c4533a7cd7d77c63367af1df2e86823dbb7
Instruction Fuzzy Hash: A34157356042628FE70CEF29D8914EA73E2EBD1320F55C23DC1568B5C5EE3A991ACB40

Function 00878147 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e579f215675dcfb273e8d2a537a31c837a53f0cbdd7f01a6d1e13fbe4514cd24
Instruction ID: 5a9040a4566c4d6bdc7cd63ec690ba905bcbf0763cc5601dde0678c0868f574b
Opcode Fuzzy Hash: e579f215675dcfb273e8d2a537a31c837a53f0cbdd7f01a6d1e13fbe4514cd24
Instruction Fuzzy Hash: 4041783560C7469BC709DE68C4504EEBBE1FFC5314F208A6DE09A8B6D5DB31980ACB85

Function 0086949D Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff158b3d624831e401fe7de77af25e30ec9a33523350161e123fa9c6c8558c9
Instruction ID: 47805e6706f443310b4942dc2827d5fdf4c7068f4cff11f01cf05b2764735c49
Opcode Fuzzy Hash: 9ff158b3d624831e401fe7de77af25e30ec9a33523350161e123fa9c6c8558c9
Instruction Fuzzy Hash: 8D41EC362409624BD728DE3DC8A14F63397DBE5320740A33D9462CF2D9EB35A60EC780

Function 00A3A399 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d454b41b705fad77c0d5a6835dc5f15486787f78c750276480e6e7492a2f455d
Instruction ID: 92b79d934ca7a066e0a01eb2b20536bd1c6c010190efae9b6eec4a5d9699d2e8
Opcode Fuzzy Hash: d454b41b705fad77c0d5a6835dc5f15486787f78c750276480e6e7492a2f455d
Instruction Fuzzy Hash: 044168356042668BD70DEF29C8914EA73E2E7D1310F51C23DC1568B5C5EE369A1AC740

Function 00AE69C3 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9033bae95b9d5d2dc0ead5dd653c9736cf27540c60f37dfc2f347f071c53e447
Instruction ID: ba9db3fe2f1747c523a2ca04de2f960a645b9be304f7530444d330ff5e7afceb
Opcode Fuzzy Hash: 9033bae95b9d5d2dc0ead5dd653c9736cf27540c60f37dfc2f347f071c53e447
Instruction Fuzzy Hash: B441CC32104B028BE71CDB34D8619EA73E2EBC6320F60877ED05ACB9C2DBB5540ECA45

Function 00AED97C Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3895174132e4f35a80e4057b6ed95c4f9b5f6455917ca1527b80329c02638d1e
Instruction ID: 2ab4fbea3ce42b7aae59dd48c12a4c99681a8a564f7781caaae7c51db0d94140
Opcode Fuzzy Hash: 3895174132e4f35a80e4057b6ed95c4f9b5f6455917ca1527b80329c02638d1e
Instruction Fuzzy Hash: 2241AA32208B124FE718DB38D4629FA73E2EFC5320FA08B7ED0968B4C6C774544ACA44

Function 009322AC Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b677b311238a0e4175a7360394180189487ed380e8f2ffe1b7f2165ff34700
Instruction ID: 5a9a685ea0a5ea8ed3e80dd075ac4343f62dacad74c83c3fb0de17bb187ebf03
Opcode Fuzzy Hash: d1b677b311238a0e4175a7360394180189487ed380e8f2ffe1b7f2165ff34700
Instruction Fuzzy Hash: CC31CE36614B124BE71CDB38C8619FA73D3DBC9320F54877DD05A8B5C6D7B5640E8604

Function 008A4CCE Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7352e29d74351ecd1efd5fe917491bd21fa71e19397df3c643d71d7d5ca12b2e
Instruction ID: 0a0c82fe1c8af9348d990d94906a90a7eaf66d87ad8b0aab687dd6326238f9d7
Opcode Fuzzy Hash: 7352e29d74351ecd1efd5fe917491bd21fa71e19397df3c643d71d7d5ca12b2e
Instruction Fuzzy Hash: 244155762292058BC70CEF29D8514EBB7D3EBE9311B10C93EE19AC7684EB34A4158B01

Function 009C2220 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef09435e6ee10f05edc075892b35d0894f18741c37b99fe6e1881adcc3d6dbc2
Instruction ID: d910e75adaad75e67dac9ccb443baaa8fe10b8f2d5cbf63e0b065de6569ccd0d
Opcode Fuzzy Hash: ef09435e6ee10f05edc075892b35d0894f18741c37b99fe6e1881adcc3d6dbc2
Instruction Fuzzy Hash: 0F31AE7791821A4BC32DEE99D8410F1B241E7D1710F10877ED99BCB4A2DB255A6B86C1

Function 0088840A Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f532a708391e162583e8babb98d869e30a76b778aa1dd6495ccba5b4d01547
Instruction ID: 0990c5bbc879762f75868bb0f1776ac0184718d6f962244d1da507821010e7ad
Opcode Fuzzy Hash: 37f532a708391e162583e8babb98d869e30a76b778aa1dd6495ccba5b4d01547
Instruction Fuzzy Hash: BB316931114B128BE71CDB38D464AEAB7D2EFC6320F648B7DD0598B5C6D7B5640ECA05

Function 00A2A802 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c2a614413e5977466e0db73c684579fb7c88ab2e3c152d58297bcfbe6129be
Instruction ID: 8c1d2b5894315910e438ecf811c622dee63650d4f7d92c2a234268fb908587a4
Opcode Fuzzy Hash: 64c2a614413e5977466e0db73c684579fb7c88ab2e3c152d58297bcfbe6129be
Instruction Fuzzy Hash: 50316C35514B124BE71CDB38D461AF6B7E2EBC5320F508B7DE05ACB5D5C7B9640ACA04

Function 0095751E Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b81358fd58b886b0f74f5ecd8031b5c708ddada1a13fb25eb9bc3264438075c
Instruction ID: a999bac7597d4b15ed1d8bb77213d554dcbc9fa25eeea208456d72487d1dacbc
Opcode Fuzzy Hash: 2b81358fd58b886b0f74f5ecd8031b5c708ddada1a13fb25eb9bc3264438075c
Instruction Fuzzy Hash: 6A31AB3A5583828BD70DEF29D4805E6B393FBD8320F6AC53D95498B648E374D927CB81

Function 00879841 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafd67bd5a8243ca5e3b281c79b2f04f66b9479bd707dc47f3977c4bdee5e713
Instruction ID: 16b52e85ab64c3c1baa3949936f93567a8e9d958f7699ce0a4e2ea66ae373cea
Opcode Fuzzy Hash: eafd67bd5a8243ca5e3b281c79b2f04f66b9479bd707dc47f3977c4bdee5e713
Instruction Fuzzy Hash: BF31C971605A274BE70DDA38C8A06EA7343E7C2335F50933D9022CB9E8EB39152ACA50

Function 009419CB Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095e0e368bf1882a0ac52c2a869724558c591adfce09742e845c54875e675e48
Instruction ID: 6df4f41e60c8899c5b89364078e4ec7d3cd5617f9cbd8e225014d6b4021ccdf1
Opcode Fuzzy Hash: 095e0e368bf1882a0ac52c2a869724558c591adfce09742e845c54875e675e48
Instruction Fuzzy Hash: 2C31A93654879A4BD714EFBCC8900FA7BD2EFCA321B14977D8086CB68AD634510BC740

Function 008929E0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b714148af4761bfe371d969782cba770986af89ad32bae8bcbf62f4a139030e
Instruction ID: 96e96345fc16aedc0f6d4d7e1965566d4d1def8010725aec21a756691c6ae4ae
Opcode Fuzzy Hash: 3b714148af4761bfe371d969782cba770986af89ad32bae8bcbf62f4a139030e
Instruction Fuzzy Hash: C0319B32214B124BE71CDB38C8A59FA73D2EBD5320F50877DD0598B5C6DBB9A40E8A04

Function 00816D10 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0dc7e1a5b3a37a228b8026488c6a7427c0d59b44e594766ff4e3fdf72e459b
Instruction ID: a018beaafdfad18b6efbfc69dbf7adc083d38d8b8c99133fb9a145e0ab2bcd59
Opcode Fuzzy Hash: 1e0dc7e1a5b3a37a228b8026488c6a7427c0d59b44e594766ff4e3fdf72e459b
Instruction Fuzzy Hash: F711C137B246720BE360DE6AECC4596635AFFE5216B1A0534EAC1C7242EA27FC61D190

Function 00A0F226 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67fa2c0f4dd0360606862afa4890c6f7d8c5749d789debb57f46314cb20a02df
Instruction ID: 7a2849efd43f325fff1e97066cba38fe2d55270ac2df50e4083de1bb5954f99f
Opcode Fuzzy Hash: 67fa2c0f4dd0360606862afa4890c6f7d8c5749d789debb57f46314cb20a02df
Instruction Fuzzy Hash: BA217B3AA146064BD718EE7E98500E67793FBDA320B00877EA4AAC73C8DA35501ACA44

Function 008336AC Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc047be68237273590d903117626f89b14762beb9f8db61748ec4783bda9adce
Instruction ID: 19de1ff78971c2cc6e104a56d242c171b323a009215a1c1da80537145d79b6f5
Opcode Fuzzy Hash: fc047be68237273590d903117626f89b14762beb9f8db61748ec4783bda9adce
Instruction Fuzzy Hash: 1221B4B5A04309CFCB108F68E8906AA7BF4FB59355F0448BDE946D7301E33AD512CB91

Function 00848C80 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: f7a17673eaab1d8fd635ebf377c25143c0b1a5bc2a71023d5fff3a9b378fc1e7
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5A110033A061D84EC3159D3C98405697FD35BA3234F5D4399F4B4DB2D2D9238D8A8364

Function 0083E7B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd4263a6600a8e6b338023b0181bc1196df4a3e081a7fe201df2049addf5b40
Instruction ID: 87d09a5ca71f258c8c13af819456f6abffe6bbeaee1dc1377314b2409eaecb88
Opcode Fuzzy Hash: ccd4263a6600a8e6b338023b0181bc1196df4a3e081a7fe201df2049addf5b40
Instruction Fuzzy Hash: 62011EF5A0130157DB209E5894C1727A2A9FFD5704F18483CE805DB282EB75EC4686E2

Function 008458B6 Relevance: 50.9, APIs: 1, Strings: 28, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0084598E

Strings

x, xrefs: 00845AAC
O, xrefs: 00845B3C
5, xrefs: 008459DC
f, xrefs: 00845ACC
+, xrefs: 00845A8C
S, xrefs: 00845A5C
U, xrefs: 00845B5C
s, xrefs: 008458C4
E, xrefs: 00845ABC
D, xrefs: 00845A9C
j, xrefs: 00845B1C
R, xrefs: 00845A4C
B, xrefs: 008459FC
0, xrefs: 00845C52
+, xrefs: 00845A6C
N, xrefs: 00845B2C
M, xrefs: 00845B0C
<, xrefs: 008459CC
R, xrefs: 00845B7C
8, xrefs: 00845A3C
a, xrefs: 00845B6C
1, xrefs: 008459EC
G, xrefs: 008458D4
A, xrefs: 00845AFC
@, xrefs: 008458E4
F, xrefs: 00845AEC
d, xrefs: 00845B4C
y, xrefs: 00845ADC

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: AllocString
String ID: +$+$0$1$5$8$<$@$A$B$D$E$F$G$M$N$O$R$R$S$U$a$d$f$j$s$x$y
API String ID: 2525500382-72532290
Opcode ID: 6aec367d5c4b3d6f95854ebe5911e28ddeeeb88a8dc06fb261e0eee243804007
Instruction ID: 82a0a579df445d45a8e62f017ae53c90277c25de15205c31e71243e5d84e15dd
Opcode Fuzzy Hash: 6aec367d5c4b3d6f95854ebe5911e28ddeeeb88a8dc06fb261e0eee243804007
Instruction Fuzzy Hash: 26A10C2150CBD2CAD332C63C8848B9FBED16BA2224F188BADD5ED9B3D2D67545058763

Function 00846257 Relevance: 29.8, APIs: 1, Strings: 16, Instructions: 92COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00846296

Strings

7, xrefs: 008462F4
], xrefs: 008462D1
S, xrefs: 00846317
Q, xrefs: 0084630D
W, xrefs: 00846303
M, xrefs: 00846321
5, xrefs: 00846308
Y, xrefs: 008462E5
!, xrefs: 008462BD
#, xrefs: 008462C7
U, xrefs: 008462F9
L, xrefs: 00846326
[, xrefs: 008462EF
O, xrefs: 0084632B
', xrefs: 008462B3
_, xrefs: 008462DB

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitVariant
String ID: !$#$'$5$7$L$M$O$Q$S$U$W$Y$[$]$_
API String ID: 1927566239-3619762162
Opcode ID: a563b401697dbbd6fc85f434a8a041d259b4991b7a44ea566b79a2066723efe7
Instruction ID: 18292accf7d12bb58989a171051d81c120c3fa1996876051e928807dca49cf7a
Opcode Fuzzy Hash: a563b401697dbbd6fc85f434a8a041d259b4991b7a44ea566b79a2066723efe7
Instruction Fuzzy Hash: 5041487040C7C1CAD365CB28849835FBFE0AB96318F488A9DE5E94B392D3B98505CB93

Function 00845DE4 Relevance: 29.8, APIs: 1, Strings: 16, Instructions: 76COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00845E0B

Strings

Y, xrefs: 00845E5A
[, xrefs: 00845E64
S, xrefs: 00845E8C
5, xrefs: 00845E7D
Q, xrefs: 00845E82
W, xrefs: 00845E78
], xrefs: 00845E46
_, xrefs: 00845E50
', xrefs: 00845E28
!, xrefs: 00845E32
#, xrefs: 00845E3C
U, xrefs: 00845E6E
M, xrefs: 00845E96
7, xrefs: 00845E69
O, xrefs: 00845EA0
L, xrefs: 00845E9B

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitVariant
String ID: !$#$'$5$7$L$M$O$Q$S$U$W$Y$[$]$_
API String ID: 1927566239-3619762162
Opcode ID: 9c6da7a3cb180ade246e578c49f204926159bf894e7ecd022c100c1bdaa6cb9f
Instruction ID: 8cf3e1fbd18d1d06c1f7e57effabdd09bee95e5e67ec24ff8e37e842b8fc9ad1
Opcode Fuzzy Hash: 9c6da7a3cb180ade246e578c49f204926159bf894e7ecd022c100c1bdaa6cb9f
Instruction Fuzzy Hash: AC41D87000C7C1CAD365CB28949875FBFE06BA6318F485A8DF5E85B392C3BA8505CB53

Function 00846518 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 91COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00846522
VariantInit.OLEAUT32 ref: 00846535

Strings

3, xrefs: 0084657A
d, xrefs: 00846593
/, xrefs: 00846566
1, xrefs: 00846584
>, xrefs: 008465BB
+, xrefs: 00846552
?, xrefs: 008465B6
;, xrefs: 008465A2
=, xrefs: 008465C0
5, xrefs: 00846598
), xrefs: 0084655C
9, xrefs: 008465AC
-, xrefs: 00846570
7, xrefs: 0084658E

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: )$+$-$/$1$3$5$7$9$;$=$>$?$d
API String ID: 2610073882-809355576
Opcode ID: b01ab03d8656445302884b90c88718e2fd55cd7cb589f6a031ff487057a3f253
Instruction ID: eb89d6b817ce2e9fbb0c758837b5b5698e7ab4680d6708b4406815c8c2e47357
Opcode Fuzzy Hash: b01ab03d8656445302884b90c88718e2fd55cd7cb589f6a031ff487057a3f253
Instruction Fuzzy Hash: 3F41397140CBC18ED322DB38844835BBFE26BE6314F594A9DE4E1473A6C674850ACB93

Function 0084BB70 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 78comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00857AA8,00000000,00000001,00857A98,00000000), ref: 0084BC97

Strings

x, xrefs: 0084BB9B
r}, xrefs: 0084BBAB
s", xrefs: 0084BBA3
:, xrefs: 0084BC4D

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: CreateInstance
String ID: :$r}$s"$x
API String ID: 542301482-3244239955
Opcode ID: fcd72b88eb27dd76dafa59f1e80fc882aa117b81c8ac6e05b7f39eedf0d23110
Instruction ID: 97d4da3430e6bcd622dff5417072c54bca8a0b76afde13057324a4e3e0391b29
Opcode Fuzzy Hash: fcd72b88eb27dd76dafa59f1e80fc882aa117b81c8ac6e05b7f39eedf0d23110
Instruction Fuzzy Hash: 3131C9769483049BE320CF15C905B4FBBE4FBC2705F118A1CF994AB290C7B88908CB93

Function 0083B070 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 322COMMON

Download Yara Rule

Strings

`c, xrefs: 0083BC99
/~, xrefs: 0083C2D8
57, xrefs: 0083BB53

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: /~$`c$57
API String ID: 0-484455979
Opcode ID: 0a0d26fd6b6834c7747c5b144062c43fdca727a1345f40b14a97de188fad7432
Instruction ID: b2b8e38dded093e1403ec4d614d732de2220ede0f108213ac37b0cea70d420b7
Opcode Fuzzy Hash: 0a0d26fd6b6834c7747c5b144062c43fdca727a1345f40b14a97de188fad7432
Instruction Fuzzy Hash: E5B1DCB4D003289FDB209F69DC4279EBBB4FF42304F1445A9D549AB341EB344A8ACF92

Function 0083BA10 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 316COMMON

Download Yara Rule

Strings

`c, xrefs: 0083BC99
/~, xrefs: 0083C2D8
57, xrefs: 0083BB53

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: /~$`c$57
API String ID: 0-484455979
Opcode ID: d842788543badc65ae91ad96bd60ed4783324915f3d6dfe5d5098f6c794694f9
Instruction ID: a33b62477c4443cd74c2c02e39f8673d90f69a9fbabe3ccce4b0afd94c3e18a3
Opcode Fuzzy Hash: d842788543badc65ae91ad96bd60ed4783324915f3d6dfe5d5098f6c794694f9
Instruction Fuzzy Hash: 28B1DCB4D003289FDB209F69DC427AEBBB4FF46304F1441A9D549AB241DB344A8ACF92

Function 00820CA0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 306COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00820CB2

Strings

Mz, xrefs: 00820E63
tO, xrefs: 00820E55

Memory Dump Source

Source File: 00000000.00000002.1691767106.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1691755475.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691796790.0000000000856000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691813054.0000000000859000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691831590.0000000000869000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692160296.0000000000B12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692181783.0000000000B13000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692844213.0000000001095000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_SecuriteInfo.jbxd

Similarity

API ID: InitializeSecurity
String ID: Mz$tO
API String ID: 640775948-2668044433
Opcode ID: d7ef9694650788df00bb7f55c121cd2d3cafb40a6970214d8e50f067236b59c4
Instruction ID: 84d4da3e0161355e037931bcf34411729c026f58a38f04f7af172ae80860877f
Opcode Fuzzy Hash: d7ef9694650788df00bb7f55c121cd2d3cafb40a6970214d8e50f067236b59c4
Instruction Fuzzy Hash: 0DA1E0B01047818FD3258F24D890766BBA1FF56305F298A9CC0D68B796D739E886CF91

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Lumma.775.32093.2339.exe

Function 0081E1A0 Relevance: 23.0, Strings: 18, Instructions: 549
COMMON

Function 0081E990 Relevance: 20.4, Strings: 16, Instructions: 352
COMMON

Function 0081CF90 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186
threadCOMMON

Function 0081F755 Relevance: 8.0, Strings: 6, Instructions: 466
COMMON

Function 0084E210 Relevance: 1.6, APIs: 1, Instructions: 65
memoryCOMMON

Function 00D09F73 Relevance: 1.5, APIs: 1, Instructions: 19
nativeCOMMON

Function 00850F10 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00851848 Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Function 00850E25 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON

Function 0084E1B0 Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON